Weakness (CWE)
CWE-835: Loop with Unreachable Exit Condition
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Source: MITRE CWE-835
619 results · Feed
-
Medium 5.7
Infinite loop in parsing PNG files in
kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is…
-
Medium 6.5
Infinite loop in aggregation expression
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB …
-
Unscored —
A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec reque…
-
Unscored —
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in…
-
High 7.5
Infinite loop in .Net Bond
A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'.
-
High 7.5
Infinite Loop in Apache Tomcat
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…
-
Medium 5.5
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when …
-
High 7.5
golang.org/x/text Infinite loop
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder insta…
-
Medium 5.5
Missing Release of Memory after Effective Lifetime in Apache Tika
A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImagePar…
-
Medium 5.5
Infinite Loop in Apache Tika
A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
-
High 7.5
Infinite Loop in jsonparser
The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.
-
High 7.5
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
-
High 7.5
An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.s…
-
High 7.5
Uncontrolled resource consumption in validators Python package
The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.
-
Medium 5.3CVE-2019-5097 EPSS 45%
A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web ser…
-
Medium 6.5
Designate does not enforce the DNS protocol limit concerning record set sizes
Designate does not enforce the DNS protocol limit concerning record set sizes
-
High 7.5
Istio vulnerable to denial of service
Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836.
-
High 7.5CVE-2019-0205 Public exploit
Loop with Unreachable Exit Condition in Apache Thrift
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects o…
-
High 7.5CVE-2019-12402 EPSS 16%
Denial of Service in Apache Commons Compress
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an …
-
High 7.5
Infinite Loop in scapy
scapy 2.4.0 is affected by: Denial of Service. The impact is: infinite loop, resource consumption and program unresponsive. The component is: _RADIUSAttrPacketListField.getfield(self..). The attack vector is: over the network or in a pcap. both work.
-
High 7.5
Infinite Loop in Apache Sanselan
Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
-
Unscored —
An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denia…
-
Medium 6.3
An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while han…
-
High 7.5CVE-2019-3833 EPSS 15%
Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing spe…
-
High 7.5
Pylons Colander Denial of Service vulnerability
In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.
-
Medium 4.2
A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may …
-
Medium 6.5
Apache Tika Denial of Service due to Infinite Loop in Tika's SQLite3Parser
A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
-
Medium 6.5
Loop with Unreachable Exit Condition in Jenkins
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
-
High 7.5
Asciidoctor Infinite Loop vulnerability
Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that Parser.next_block was not exhausting all the lines in the reader as the while loop expected it would. This was happening…
-
High 7.5
x/net/html Vulnerable to DoS During HTML Parsing
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.
-
Medium 5.5
Comparison errorr in org.apache.tika:tika-core
In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
-
Medium 5.3
An infinite loop vulnerability was found in libtirpc before version 1.0.2-rc2. With the port to using poll rather than …
-
Medium 6.5
Infinite Loop in Jenkins Core
A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
-
Medium 5.5
Moderate severity vulnerability that affects org.apache.commons:commons-compress
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamRe…
-
High 7.5CVE-2018-1336 EPSS 20%
In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to…
-
Low 3.3
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in open…
-
High 7.5
Keycloak vulnerable to infinite loop based Denial of Service
It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.
-
High 7.5
Moderate severity vulnerability that affects io.undertow:undertow-core
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
-
Medium 4.4
Moderate severity vulnerability that affects org.keycloak:keycloak-core
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw…
-
Medium 6.5
Loop with Unreachable Exit Condition in Apache PDFBox
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.