Weakness (CWE)
CWE-835: Loop with Unreachable Exit Condition
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Source: MITRE CWE-835
24 results · Clear filters · Feed
-
Low 2.3
In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structur…
-
Low 2.9
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant…
-
Low 2.1
Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
-
Low 2.0
NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS
NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE packet. A zero-length to…
-
Low 2.8
An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, E…
-
Low 2.4
DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS)
In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET i…
-
Low 3.1
Libssh: libssh: denial of service via automatic certificate authentication loop
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
-
Low 3.1
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server
### Impact Unauthenticated denial of service. ### Summary When installing provider or module packages from attacker-controlled servers, the server may cause `tofu init`to enter an infinite loop sending garbage data to that server. Those who depend on modules …
-
Low 1.2
pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
pypdf is a free and open-source pure-python PDF library. Prior to 6.7.2, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires reading the file. This has been fixed in pypdf 6.7.2. As a workaround, one may appl…
-
Low 1.7
Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoS
Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6.11, a remotely triggerable Out-of-Memory (OOM) denial-of-service exists in Fast -DDS when processin…
-
Low 3.7
Denial of service via crafted DoH exchange in PowerDNS DNSdist
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an une…
-
Low 2.9
Low severity (DoS) vulnerability in sequoia-openpgp
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
-
Low 2.7
Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application)
SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected res…
-
Low 3.3
SourceCodester Student Record Management System Main Menu infinite loop
A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the component Main Menu. The manipulation leads to infinite loop. Attacking locally is a requiremen…
-
Low 3.7CVE-2024-33623 EPSS 12%
A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially…
-
Low 3.1
Unbounded loop over untrusted input can lead to endless data attack
sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form…
-
Low 3.3
GPAC MP4Box isoffin_read.c isoffin_process infinite loop
A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to inf…
-
Low 3.1
Denial of service from malicious image manifest in kyverno
Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registr…
-
Low 3.1
Denial of service from malicious image manifest in kyverno
Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry f…
-
Low 3.1
Possible endless data attack from attacker-controlled registry in cosign
Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls a remote registry can return a high number of attestations and/or signatures to Cosign and cause Co…
-
Low 3.5
Inifinite loop in babld message parsing may cause dos
A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that…
-
Low 2.8
InternalError503 Forget It settings.js infinite loop
A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is pos…
-
Low 3.3
Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic
Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usa…
-
Low 3.3
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in open…