cve.bz

CWE-835: Loop with Unreachable Exit Condition (Infinite Loop)

Filter

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

What the weakness is: CWE-835 at MITRE

Ask an AI about CWE-835

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-835: Loop with Unreachable Exit Condition and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/835.html and https://cve.bz/cve/cwe/835?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2026-120251EPSS 0.1%

    imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attackers to hang the calling process by supplying a crafted CCITT Group 4 stream. Attackers can provide an 8-byte G4 s…

  2. 7.5CVE-2026-120194EPSS 0.5%

    A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can…

  3. 5.5CVE-2026-62250EPSS 0.2%

    LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR1…

  4. 7.1CVE-2026-119205EPSS 0.3%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop when cloning or duplicating a crafted cyclic DictionaryObject. Clone traversal checked generated destination references rather than …

  5. 7.1CVE-2026-119203EPSS 0.3%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can enter an infinite loop while opening a crafted incomplete PDF whose standard cross-reference table reaches the end of the file without a trailer. The trail…

  6. 2.9CVE-2026-118781EPSS 0.1%

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to …

  7. 8.7CVE-2026-111731EPSS 0.4%

    P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the request never completes and the device st…

  8. –CVE-2026-111496EPSS 0.2%

    Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near …

  9. 7.5CVE-2026-103410EPSS 0.3%

    An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.

  10. 7.5CVE-2026-118037EPSS 0.3%

    In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStream…

  11. 7.5CVE-2026-118036EPSS 0.4%

    In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summari…

  12. 7.5CVE-2026-118035EPSS 0.3%

    In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to termi…

  13. 4.3CVE-2026-116774EPSS 0.3%

    russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writabl…

  14. 6.5CVE-2026-109088EPSS 0.3%

    A malicious X server could send malformed  RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.

  15. 2.1CVE-2026-116671EPSS 0.1%

    Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.

  16. 7.5CVE-2026-116581EPSS 0.5%

    Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create…

  17. 8.7CVE-2026-115269EPSS 0.6%

    Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS…

  18. 4.9CVE-2026-115774EPSS 0.5%

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH…

  19. 6.0CVE-2026-66281EPSS 0.3%

    In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporti…

  20. 7.5CVE-2026-110354EPSS 0.8%

    HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the strea…

  21. 7.1CVE-2026-96642EPSS 0.3%

    Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does …

  22. 5.3CVE-2026-76445EPSS 0.5%

    Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) cond…

  23. 5.8CVE-2026-20019EPSS 0.5%

    Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet i…

  24. 6.0CVE-2026-113794EPSS 0.5%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinit…

  25. 6.0CVE-2026-113793EPSS 0.5%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version …

  26. 6.0CVE-2026-113792EPSS 0.5%

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in…

  27. 8.7CVE-2026-111074EPSS 0.4%

    In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `Mess…

  28. 7.1CVE-2026-114095EPSS 0.3%

    Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA de…

  29. 8.1CVE-2026-92387EPSS 1.0%

    By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound …

  30. 6.8CVE-2026-92454EPSS 0.2%

    The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma s…

  31. 8.7CVE-2026-112406EPSS 0.6%

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can su…

  32. 6.3CVE-2026-112391EPSS 0.6%

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF i…

  33. 8.2CVE-2026-112390EPSS 0.6%

    Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index…

  34. 6.8CVE-2026-112046EPSS 0.1%

    OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed cod…

  35. 8.7CVE-2026-68906EPSS 0.5%

    libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validatin…

  36. 8.7CVE-2026-107621EPSS 0.4%

    JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.

  37. 8.7CVE-2026-105273EPSS 0.4%

    MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

  38. 7.5CVE-2026-97370EPSS 0.4%

    Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared …

  39. 6.5CVE-2026-104266EPSS 0.3%

    tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a ---- atom can cause the metadata parser to stop advancing through the input. The custom-fie…

  40. 7.1CVE-2026-110836EPSS 0.3%

    FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Co…

  41. 7.5CVE-2026-107349EPSS 0.4%

    An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_…

  42. 5.9CVE-2026-107348EPSS 0.4%

    Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a …

  43. 5.9CVE-2026-96596EPSS 0.2%

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacke…

  44. 8.7CVE-2026-102185EPSS 0.4%

    A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote network attacker to cause a denial of service via EVPN multihomin…

  45. 8.7CVE-2026-102046EPSS 0.5%

    A Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in netsctp.ko of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to cause a denial of service via crafted SCTP network traffic.

  46. 8.7CVE-2026-101895EPSS 0.9%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infin…

  47. 6.8CVE-2016-20099EPSS 0.2%

    L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, whi…

  48. 6.5CVE-2026-78633EPSS 0.2%

    The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIU…

  49. 7.1CVE-2026-109941EPSS 0.3%

    FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or foote…

  50. 7.5CVE-2026-109832EPSS 0.4%

    A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to…