CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1195 vulnerabilities reference this CWE, most recent first.
GHSA-8G7P-JF3G-GXCP
Vulnerability from github – Published: 2026-03-23 06:30 – Updated: 2026-07-21 13:42Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jsrsasign"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-4598"
],
"database_specific": {
"cwe_ids": [
"CWE-1287",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-29T15:51:28Z",
"nvd_published_at": "2026-03-23T06:16:21Z",
"severity": "HIGH"
},
"details": "Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process permanently by supplying such crafted values (e.g., modInverse(0, m) or modInverse(-1, m)).",
"id": "GHSA-8g7p-jf3g-gxcp",
"modified": "2026-07-21T13:42:15Z",
"published": "2026-03-23T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4598"
},
{
"type": "WEB",
"url": "https://github.com/kjur/jsrsasign/pull/648"
},
{
"type": "WEB",
"url": "https://github.com/kjur/jsrsasign/commit/ca5b027240287a1e71fe63019fc4400332594323"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370938"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-15812263"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4598.json"
},
{
"type": "PACKAGE",
"url": "https://github.com/kjur/jsrsasign"
},
{
"type": "WEB",
"url": "https://gist.github.com/Kr0emer/a1bf5cd4547cc630d2dcc5e761de8264"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450210"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-4598"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:6568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23361"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22840"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19410"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19409"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs"
}
GHSA-8G9J-VP2C-MG7R
Vulnerability from github – Published: 2022-05-13 01:52 – Updated: 2022-05-13 01:52The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.
{
"affected": [],
"aliases": [
"CVE-2018-5253"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-05T21:29:00Z",
"severity": "HIGH"
},
"details": "The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling.",
"id": "GHSA-8g9j-vp2c-mg7r",
"modified": "2022-05-13T01:52:45Z",
"published": "2022-05-13T01:52:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5253"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/233"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H93-38HX-VV92
Vulnerability from github – Published: 2025-06-07 09:30 – Updated: 2025-06-09 15:31Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop.
There is no other way for the application to escape or exit this loop other than killing the thread/process.
This might be used to DoS libcurl-using application.
{
"affected": [],
"aliases": [
"CVE-2025-5399"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-07T08:15:20Z",
"severity": "HIGH"
},
"details": "Due to a mistake in libcurl\u0027s WebSocket code, a malicious server can send a\nparticularly crafted packet which makes libcurl get trapped in an endless\nbusy-loop.\n\nThere is no other way for the application to escape or exit this loop other\nthan killing the thread/process.\n\nThis might be used to DoS libcurl-using application.",
"id": "GHSA-8h93-38hx-vv92",
"modified": "2025-06-09T15:31:41Z",
"published": "2025-06-07T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5399"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3168039"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-5399.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-5399.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/06/04/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8H9F-G8Q9-87R3
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50An issue has been found in dbf2txt through 2012-07-19. It is a infinite loop.
{
"affected": [],
"aliases": [
"CVE-2018-17042"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-14T07:29:00Z",
"severity": "MODERATE"
},
"details": "An issue has been found in dbf2txt through 2012-07-19. It is a infinite loop.",
"id": "GHSA-8h9f-g8q9-87r3",
"modified": "2022-05-13T01:50:29Z",
"published": "2022-05-13T01:50:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17042"
},
{
"type": "WEB",
"url": "https://github.com/bcsanches/dbf2txt/issues/2"
},
{
"type": "WEB",
"url": "https://github.com/grandnew/software-vulnerabilities/tree/master/dbf2txt#infinite-loop"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8J7J-8W2R-72PQ
Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2023-02-03 00:30When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
{
"affected": [],
"aliases": [
"CVE-2020-15654"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-10T18:15:00Z",
"severity": "MODERATE"
},
"details": "When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR \u003c 78.1, Firefox \u003c 79, and Thunderbird \u003c 78.1.",
"id": "GHSA-8j7j-8w2r-72pq",
"modified": "2023-02-03T00:30:18Z",
"published": "2022-05-24T17:25:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15654"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1648333"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4443-1"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-30"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-32"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2020-33"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8J7Q-4Q44-6HPF
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47The mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.
{
"affected": [],
"aliases": [
"CVE-2017-9222"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-27T12:29:00Z",
"severity": "HIGH"
},
"details": "The mp4ff_parse_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.",
"id": "GHSA-8j7q-4q44-6hpf",
"modified": "2022-05-13T01:47:51Z",
"published": "2022-05-13T01:47:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9222"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Jun/32"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8JJ7-4V57-FRF5
Vulnerability from github – Published: 2026-08-24 20:09 – Updated: 2026-08-24 20:09Summary
The move_plugin admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker.
Details
move_plugin (in cms/admin/placeholderadmin.py) accepts a plugin_parent POST parameter and, for an in-placeholder move, sets the plugin's parent to the target without any cycle/ancestor check. If the target parent is a descendant of the moved plugin, the resulting parent_id graph contains a cycle.
Descendant and ancestor traversal is implemented with WITH RECURSIVE CTEs (_get_descendants_cte / _get_ancestors_cte in cms/models/pluginmodel.py) that have no cycle clause or depth limit. On a cyclic tree these recurse indefinitely (PostgreSQL/SQLite) or error at the recursion limit (MySQL). get_descendants() is invoked while building the move response and on subsequent operations on the affected subtree.
Impact
An authenticated staff user with permission to change plugins in at least one placeholder can corrupt that placeholder's plugin tree, causing requests that traverse it (rendering, copy, delete) to hang and consume application workers (denial of service). The tree is also left in a corrupted state.
Requires CMS_PERMISSION/plugin-change permission on a placeholder.
Patches
Fixed in 5.0.8: move_plugin now rejects (HTTP 400) any move that would place a plugin inside itself or one of its descendants, before any tree mutation or traversal.
Workarounds
None. Upgrade is recommended.
Credits
Reported by the security team at the University of Sydney ([@reporter]).
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django-cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54623"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-24T20:09:43Z",
"nvd_published_at": "2026-08-20T18:16:28Z",
"severity": "HIGH"
},
"details": "### Summary\nThe `move_plugin` admin endpoint does not prevent a plugin from being reparented under itself or one of its own descendants. Doing so creates a cycle in the plugin tree, after which the recursive descendant/ancestor SQL queries loop without terminating, stalling the request worker.\n\n### Details\n`move_plugin` (in `cms/admin/placeholderadmin.py`) accepts a `plugin_parent` POST parameter and, for an in-placeholder move, sets the plugin\u0027s parent to the target without any cycle/ancestor check. If the target parent is a descendant of the moved plugin, the resulting `parent_id` graph contains a cycle.\n\nDescendant and ancestor traversal is implemented with `WITH RECURSIVE` CTEs (`_get_descendants_cte` / `_get_ancestors_cte` in `cms/models/pluginmodel.py`) that have no cycle clause or depth limit. On a cyclic tree these recurse indefinitely (PostgreSQL/SQLite) or error at the recursion limit (MySQL). `get_descendants()` is invoked while building the move response and on subsequent operations on the affected subtree.\n\n### Impact\nAn authenticated staff user with permission to change plugins in at least one placeholder can corrupt that placeholder\u0027s plugin tree, causing requests that traverse it (rendering, copy, delete) to hang and consume application workers (denial of service). The tree is also left in a corrupted state.\n\nRequires `CMS_PERMISSION`/plugin-change permission on a placeholder.\n\n### Patches\nFixed in 5.0.8: `move_plugin` now rejects (HTTP 400) any move that would place a plugin inside itself or one of its descendants, before any tree mutation or traversal.\n\n### Workarounds\nNone. Upgrade is recommended.\n\n### Credits\nReported by the security team at the University of Sydney ([@reporter]).",
"id": "GHSA-8jj7-4v57-frf5",
"modified": "2026-08-24T20:09:43Z",
"published": "2026-08-24T20:09:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/security/advisories/GHSA-8jj7-4v57-frf5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54623"
},
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/pull/8645"
},
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/commit/7642a98ab3170793c0b27b4125dd1f3d318b8a1c"
},
{
"type": "PACKAGE",
"url": "https://github.com/django-cms/django-cms"
},
{
"type": "WEB",
"url": "https://github.com/django-cms/django-cms/releases/tag/5.0.8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "django CMS: Plugin move endpoint allows cyclic reparenting (DoS)"
}
GHSA-8M8H-XWP6-PGJF
Vulnerability from github – Published: 2025-11-18 18:32 – Updated: 2025-11-18 18:32eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function.
{
"affected": [],
"aliases": [
"CVE-2025-63829"
],
"database_specific": {
"cwe_ids": [
"CWE-190",
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-18T17:16:12Z",
"severity": "MODERATE"
},
"details": "eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function.",
"id": "GHSA-8m8h-xwp6-pgjf",
"modified": "2025-11-18T18:32:54Z",
"published": "2025-11-18T18:32:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63829"
},
{
"type": "WEB",
"url": "https://gist.github.com/lkloliver/b00377bec754d4aa1dc731be210d5889"
},
{
"type": "WEB",
"url": "https://github.com/eProsima/Fast-DDS/blob/master/src/cpp/fastdds/core/Time_t.cpp#L67"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8M9G-647G-5PXW
Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2021-05-07 16:04An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/Yubico/yubihsm-connector"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28484"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T16:04:45Z",
"nvd_published_at": "2021-04-14T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.",
"id": "GHSA-8m9g-647g-5pxw",
"modified": "2021-05-07T16:04:45Z",
"published": "2022-02-15T01:57:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28484"
},
{
"type": "WEB",
"url": "https://github.com/Yubico/yubihsm-connector/commit/82bdf202c53460bac9106cc9b4b34a0a16cae0ed"
},
{
"type": "WEB",
"url": "https://github.com/Yubico/yubihsm-connector/releases"
},
{
"type": "WEB",
"url": "https://www.yubico.com/support/security-advisories/ysa-2021-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R",
"type": "CVSS_V3"
}
],
"summary": "Infinite loop in Yubico yubihsm-connector"
}
GHSA-8MMP-C685-53VW
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2022-08-05 00:00encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.
{
"affected": [],
"aliases": [
"CVE-2021-27918"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-11T00:15:00Z",
"severity": "HIGH"
},
"details": "encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.",
"id": "GHSA-8mmp-c685-53vw",
"modified": "2022-08-05T00:00:28Z",
"published": "2022-05-24T17:44:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27918"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.