Common Weakness Enumeration
CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1081 vulnerabilities reference this CWE, most recent first.
GHSA-WW4V-Q9H8-2Q3M
Vulnerability from github – Published: 2024-09-05 00:31 – Updated: 2024-09-05 15:33
VLAI
Details
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-45692"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T23:15:12Z",
"severity": "HIGH"
},
"details": "Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.",
"id": "GHSA-ww4v-q9h8-2q3m",
"modified": "2024-09-05T15:33:35Z",
"published": "2024-09-05T00:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45692"
},
{
"type": "WEB",
"url": "https://cispa.de/en/loop-dos"
},
{
"type": "WEB",
"url": "https://webmin.com"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/09/04/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WW5R-X8XX-G992
Vulnerability from github – Published: 2022-08-11 00:00 – Updated: 2022-08-13 00:00
VLAI
Details
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-34661"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-10T12:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.15), Teamcenter V13.0 (All versions \u003c V13.0.0.10), Teamcenter V13.1 (All versions \u003c V13.1.0.10), Teamcenter V13.2 (All versions \u003c V13.2.0.9), Teamcenter V13.3 (All versions \u003c V13.3.0.5), Teamcenter V14.0 (All versions \u003c V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.",
"id": "GHSA-ww5r-x8xx-g992",
"modified": "2022-08-13T00:00:35Z",
"published": "2022-08-11T00:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34661"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-759952.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WW72-35H4-5V84
Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2022-05-13 01:17
VLAI
Details
The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2016-6301"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-09T20:59:00Z",
"severity": "HIGH"
},
"details": "The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.",
"id": "GHSA-ww72-35h4-5v84",
"modified": "2022-05-13T01:17:59Z",
"published": "2022-05-13T01:17:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6301"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1363710"
},
{
"type": "WEB",
"url": "https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Jun/14"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Sep/7"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-05"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Jun/18"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Sep/7"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Aug/20"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Mar/15"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/08/03/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92277"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WWC3-65MG-QWXF
Vulnerability from github – Published: 2026-04-30 09:30 – Updated: 2026-04-30 15:30
VLAI
Details
SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-5407"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-30T07:16:38Z",
"severity": "MODERATE"
},
"details": "SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service",
"id": "GHSA-wwc3-65mg-qwxf",
"modified": "2026-04-30T15:30:38Z",
"published": "2026-04-30T09:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5407"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/21073"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/work_items/21073"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-11.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WWH4-WJHP-4XRG
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-12 00:01
VLAI
Details
Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-1222"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T10:15:00Z",
"severity": "MODERATE"
},
"details": "Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV.",
"id": "GHSA-wwh4-wjhp-4xrg",
"modified": "2022-04-12T00:01:01Z",
"published": "2022-04-05T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1222"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/commit/7f060bbb72966cae80d6fee338d0b07fa3fc06e1"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/f8cb85b8-7ff3-47f1-a9a6-7080eb371a3d"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5411"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WWXC-Q95Q-9VH6
Vulnerability from github – Published: 2021-12-22 00:00 – Updated: 2021-12-28 00:01
VLAI
Details
An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2021-44924"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-21T21:15:00Z",
"severity": "MODERATE"
},
"details": "An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.",
"id": "GHSA-wwxc-q95q-9vh6",
"modified": "2021-12-28T00:01:05Z",
"published": "2021-12-22T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44924"
},
{
"type": "WEB",
"url": "https://github.com/gpac/gpac/issues/1959"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WX33-XP59-J4CH
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-12-21 15:30
VLAI
Details
A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-3508"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-28T14:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a crafted PDF file.",
"id": "GHSA-wx33-xp59-j4ch",
"modified": "2022-12-21T15:30:16Z",
"published": "2022-05-24T17:49:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3508"
},
{
"type": "WEB",
"url": "https://github.com/enferex/pdfresurrect/issues/17"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1951198"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WXR6-PC3H-29GG
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-04-20 03:36
VLAI
Details
In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-7748"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-12T23:59:00Z",
"severity": "HIGH"
},
"details": "In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check.",
"id": "GHSA-wxr6-pc3h-29gg",
"modified": "2025-04-20T03:36:01Z",
"published": "2022-05-13T01:47:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7748"
},
{
"type": "WEB",
"url": "https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13581"
},
{
"type": "WEB",
"url": "https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f55cbcde2c8f74b652add4450b0592082eb6acff"
},
{
"type": "WEB",
"url": "https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f55cbcde2c8f74b652add4450b0592082eb6acff"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2017-21.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97628"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X2FM-93WW-GGVX
Vulnerability from github – Published: 2022-05-13 01:02 – Updated: 2023-06-09 23:06
VLAI
Summary
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Details
parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-16932"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-09T23:06:12Z",
"nvd_published_at": "2017-11-23T21:29:00Z",
"severity": "HIGH"
},
"details": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.",
"id": "GHSA-x2fm-93ww-ggvx",
"modified": "2023-06-09T23:06:12Z",
"published": "2022-05-13T01:02:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16932"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/issues/1714"
},
{
"type": "WEB",
"url": "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961"
},
{
"type": "WEB",
"url": "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html"
},
{
"type": "WEB",
"url": "https://bugzilla.gnome.org/show_bug.cgi?id=759579"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3739-1"
},
{
"type": "WEB",
"url": "http://xmlsoft.org/news.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nokogiri gem, via libxml, is affected by DoS vulnerabilities"
}
GHSA-X2MW-9W7G-6QH6
Vulnerability from github – Published: 2025-02-03 12:31 – Updated: 2025-02-03 18:30
VLAI
Details
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a non-privileged user process to make valid GPU memory processing operations, including via WebGL or WebGPU, to cause the whole system to become unresponsive.This issue affects Bifrost GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Valhall GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Arm 5th Gen GPU Architecture Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0.
Severity
4.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-6790"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-03T11:15:09Z",
"severity": "MODERATE"
},
"details": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a non-privileged user process to make valid GPU memory processing operations, including via WebGL or WebGPU, to cause the whole system to become unresponsive.This issue affects Bifrost GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Valhall GPU Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0; Arm 5th Gen GPU Architecture Kernel Driver: r44p1, from r46p0 through r49p0, from r50p0 through r51p0.",
"id": "GHSA-x2mw-9w7g-6qh6",
"modified": "2025-02-03T18:30:41Z",
"published": "2025-02-03T12:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6790"
},
{
"type": "WEB",
"url": "https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.