cve.bz

CWE-835: Loop with Unreachable Exit Condition (Infinite Loop), page 12

Filter

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

What the weakness is: CWE-835 at MITRE

Ask an AI about CWE-835

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-835: Loop with Unreachable Exit Condition and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/835.html and https://cve.bz/cve/cwe/835?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2022-39052EPSS 0.7%

    An external attacker is able to send a specially crafted email (with many recipients) and trigger a potential DoS of the system

  2. 5.5CVE-2022-42721EPSS 0.6%

    A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.

  3. 5.5CVE-2014-0148EPSS 0.3%

    Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to …

  4. 5.5CVE-2022-31628EPSS 0.6%

    In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

  5. 5.5CVE-2022-28886EPSS 0.5%

    A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine

  6. 7.5CVE-2022-3252EPSS 0.8%

    Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (HTTPRequestDecompressor and HTTPResponseDecompre…

  7. 5.5CVE-2022-3190EPSS 2.3%

    Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file

  8. 7.5CVE-2021-37819EPSS 0.8%

    PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.

  9. 7.5CVE-2022-28884EPSS 0.5%

    A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.

  10. 5.9CVE-2021-44718EPSS 0.8%

    wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle (MITM) position. The root cause is that the client module accepts TLS m…

  11. 7.5CVE-2022-28882EPSS 0.5%

    A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE files. This eventually leads to scanning engine crash. The exploit can be trigge…

  12. 7.5CVE-2022-37768EPSS 1.1%

    libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.

  13. 5.5CVE-2022-35166EPSS 0.3%

    libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.

  14. 5.5CVE-2022-35165EPSS 0.3%

    An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input.

  15. 3.2CVE-2020-14394EPSS 0.4%

    An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a…

  16. 7.5CVE-2022-2833EPSS 1.2%

    Endless Infinite loop in Blender-thumnailing due to logical bugs.

  17. 7.5CVE-2022-34661EPSS 0.8%

    A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 …

  18. 7.5CVE-2022-35724EPSS 1.8%

    It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update …

  19. 7.5CVE-2022-34862EPSS 1.3%

    In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when an LTM virtual server is configured to perform normalization, undisclosed requests can cause the Traffic Management M…

  20. 5.5CVE-2022-36313EPSS 0.4%

    An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsi…

  21. 7.5CVE-2021-46828EPSS 3.2%

    In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connect…

  22. 7.5CVE-2022-30634EPSS 2.3%

    Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

  23. 7.5CVE-2022-34760EPSS 0.8%

    A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies. Affected Products: X80 advanced RTU Communication Module …

  24. 7.5CVE-2022-32058EPSS 1.3%

    An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

  25. 7.5CVE-2022-29862EPSS 1.7%

    An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.

  26. 7.5CVE-2022-25851EPSS 1.9%

    The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return.

  27. 5.5CVE-2021-40592EPSS 0.9%

    GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process()…

  28. 7.5CVE-2022-27781EPSS 2.9%

    libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never…

  29. 7.5CVE-2022-29190EPSS 1.7%

    Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There ar…

  30. 5.5CVE-2022-29028EPSS 0.5%

    A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Tiff_Loader.dll is vulnerable to infinite lo…

  31. 7.5CVE-2022-24792EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerabil…

  32. 5.5CVE-2022-24859EPSS 1.3%

    PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo…

  33. 7.5CVE-2022-21159EPSS 1.8%

    A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence …

  34. 5.5CVE-2022-24191EPSS 0.7%

    In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow.

  35. 5.5CVE-2022-1222EPSS 0.8%

    Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.

  36. 7.5CVE-2022-24763EPSS 2.1%

    PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users ar…

  37. 7.5CVE-2022-23352EPSS 1.6%

    An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).

  38. 6.5CVE-2021-20257EPSS 0.4%

    An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a gu…

  39. 7.5CVE-2022-0778EPSS 73%

    The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in …

  40. 7.5CVE-2021-3737EPSS 13%

    A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest …

  41. 7.5CVE-2022-0711EPSS 17%

    A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of s…

  42. 6.5CVE-2022-23641EPSS 1.2%

    Discourse is an open source discussion platform. In versions prior to 2.8.1 in the `stable` branch, 2.9.0.beta2 in the `beta` branch, and 2.9.0.beta2 in the `tests-passed` branch, users can trigger a Denial of Service attack by posting a s…

  43. 7.5CVE-2022-0586EPSS 2.0%

    Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file

  44. 7.5CVE-2022-23833EPSS 50%

    An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

  45. 7.5CVE-2022-23596EPSS 1.6%

    Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whet…

  46. 7.5CVE-2022-23098EPSS 2.5%

    An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.

  47. 7.5CVE-2022-23968EPSS 1.9%

    Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image par…

  48. 6.5CVE-2022-23437EPSS 12%

    There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources…

  49. 7.5CVE-2021-23567EPSS 1.7%

    The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to mak…

  50. 7.5CVE-2021-45445EPSS 1.0%

    Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.