Weakness (CWE)
CWE-835: Loop with Unreachable Exit Condition
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Source: MITRE CWE-835
280 results · Clear filters · Feed
-
Medium 6.5
Apache MINA HTTP listener DOS
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update …
-
Medium 6.5
Junos OS and Junos OS Evolved: Receipt of a specific LDP message will cause a Denial of Service
In an MPLS P2MP environment a Loop with Unreachable Exit Condition vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause high load on RPD which in turn may lea…
-
Medium 4.3
Denial of service while parsing polymorphic input with tagged polymorphism style in kaml
kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsin…
-
Medium 6.5
XStream can cause a Denial of Service
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting …
-
Medium 5.5
Infinite loop in TensorFlow Lite
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [elli…
-
Medium 5.5
Denial of service due to integer overflow in loop counter
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the…
-
Medium 5.5
Denial of service due to infinite loop in JpegBase::printStructure (#2)
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metada…
-
Medium 5.5
Denial of service due to infinite loop in JpegBase::printStructure (#1)
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to modify the metada…
-
Medium 5.5
Denial of service due to infinite loop in Image::printIFDStructure
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadat…
-
Medium 5.5
A carefully crafted PDF file can trigger an infinite loop while loading the file
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
-
Medium 4.0
Remote Denial of Service in LwM2M do_write_op_tlv
Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835). For more information, see https://github.com/zephyrproject-rto…
-
Medium 5.3
Junos OS and Junos OS Evolved: Trio Chipset: Denial of Service due to packet destined to device's interfaces.
An always-incorrect control flow implementation in the implicit filter terms of Juniper Networks Junos OS and Junos OS Evolved on ACX5800, EX9200 Series, MX10000 Series, MX240, MX480, MX960 devices with affected Trio line cards allows an attacker to exploit a…
-
Medium 6.5
Infinite loop in Yubico yubihsm-connector
An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in…
-
Medium 5.5
Infinite loop in Apache Tika's MP3 parser
A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.
-
Medium 5.5
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input…
-
Medium 5.7
Infinite loop in parsing PNG files in
kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is…
-
Medium 6.5
Infinite loop in aggregation expression
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB …
-
Medium 5.5
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …
-
Medium 5.5
Missing Release of Memory after Effective Lifetime in Apache Tika
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImagePar…
-
Medium 5.5
Infinite Loop in Apache Tika
A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
-
Medium 5.3CVE-2019-5097 EPSS 45%
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web ser…
-
Medium 6.5
Designate does not enforce the DNS protocol limit concerning record set sizes
Designate does not enforce the DNS protocol limit concerning record set sizes
-
Medium 6.3
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while han…
-
Medium 4.2
A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may …
-
Medium 6.5
Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
-
Medium 6.5
Loop with Unreachable Exit Condition in Jenkins
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
-
Medium 5.5
Comparison errorr in org.apache.tika:tika-core
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
-
Medium 5.3
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than …
-
Medium 6.5
Infinite Loop in Jenkins Core
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
-
Medium 5.5
Moderate severity vulnerability that affects org.apache.commons:commons-compress
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamRe…
-
Medium 4.4
Moderate severity vulnerability that affects org.keycloak:keycloak-core
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw…
-
Medium 6.5
Loop with Unreachable Exit Condition in Apache PDFBox
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
-
Medium 5.5CVE-2018-12418 Public exploit
Junrar vulnerable to Infinite Loop
Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.
-
Medium 5.5
Moderate severity vulnerability that affects org.apache.tika:tika-core
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
-
Medium 5.5
org.apache.tika:tika-parsers has an Infinite Loop vulnerability
A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
-
Medium 5.5CVE-2018-1324 Public exploit
Apache Commons Compress vulnerable to denial of service due to infinite loop
A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack ag…
-
Medium 4.0
Denial of Service in docker2aci
docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
-
Medium —
Loop with Unreachable Exit Condition in Apache POI
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
-
Medium —
Loop with Unreachable Exit Condition in Apache CXF
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
-
Medium —
Rack vulnerable to REDoS
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.