CWE-835 · Loop with Unreachable Exit Condition (Infinite Loop) (page 2)
Page 2 of 10 — CVEs classified under CWE-835, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15163 | Medium | 5.5 | 2026-07-08 | Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service |
CVE-2026-59935 | High | 7.5 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an attacker can craft a PDF with a page content stream containing a not terminated in… |
CVE-2026-59879 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functiona… |
CVE-2026-59877 | Medium | 5.3 | 2026-07-08 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema t… |
CVE-2026-59874 | High | 7.5 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded e… |
CVE-2026-11352 | High | 7.5 | 2026-07-03 | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because t… |
CVE-2026-54886 | Medium | 4.3 | 2026-07-02 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP c… |
CVE-2026-55595 | Medium | 4.7 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, when providing invalid… |
CVE-2026-6684 | Medium | 4.6 | 2026-07-01 | FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header field GPTH_PtNum, enabli… |
CVE-2026-14258 | Medium | 6.5 | 2026-07-01 | A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Ne… |
CVE-2026-53312 | Medium | 5.5 | 2026-06-26 | In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Remove overflows on the invalidation path Since RISC-V supports a sign exten… |
CVE-2026-10642 | Medium | 4.6 | 2026-06-24 | The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable() that repeatedly invokes the interrupt-d… |
CVE-2026-54904 | High | 7.5 | 2026-06-24 | concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the curre… |
CVE-2026-52965 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure When ttm_tt_swapout()… |
CVE-2026-52933 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() u… |
CVE-2026-52921 | Medium | 5.5 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: stop hash:* range iteration at end The following hash set variants: ha… |
CVE-2026-54651 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo… |
CVE-2026-54531 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo… |
CVE-2026-54530 | Medium | 5.5 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite lo… |
CVE-2026-48986 | Medium | 4.7 | 2026-06-18 | pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 and earlier, usb_get_process_parent_id() can cause an infinite loop… |
CVE-2026-55199 | Medium | 5.9 | 2026-06-17 | libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c… |
CVE-2026-54417 | High | 7.5 | 2026-06-17 | An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU c… |
CVE-2026-48733 | Medium | 4.7 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-49 and 7.1.2-24, an infinite loop in th… |
CVE-2026-46521 | Medium | 5.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compre… |
CVE-2026-46522 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check… |
CVE-2026-49495 | Medium | 5.5 | 2026-06-10 | Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O… |
CVE-2025-71330 | High | 7.5 | 2026-06-10 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2025-71329 | High | 7.5 | 2026-06-10 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2025-71319 | High | 7.5 | 2026-06-09 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2026-46314 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() w… |
CVE-2026-44186 | High | 7.3 | 2026-06-08 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP… |
CVE-2026-44740 | Medium | 6.5 | 2026-06-01 | Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed… |
CVE-2026-46385 | High | 7.5 | 2026-05-29 | iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking… |
CVE-2026-41150 | Medium | 5.3 | 2026-05-29 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-servi… |
CVE-2026-10028 | Medium | 4.3 | 2026-05-28 | A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application tha… |
CVE-2026-46146 | Medium | 5.5 | 2026-05-28 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() The convert_chmap_v3(… |
CVE-2026-45919 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Skip currently executing CPU in rto_next_cpu() CPU0 becomes overloaded when hos… |
CVE-2026-45864 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same When processing… |
CVE-2026-49017 | Medium | 6.5 | 2026-05-27 | In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingIn… |
CVE-2026-47066 | High | 7.5 | 2026-05-25 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in benoitc hackney allows Excessive Allocation. The Alt-Svc response header parser in src/… |
CVE-2026-32739 | Medium | 6.5 | 2026-05-19 | libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 800-byte HEIF sequence file causes an infinite loop in Box_… |
CVE-2026-43486 | Medium | 5.5 | 2026-05-13 | In the Linux kernel, the following vulnerability has been resolved: arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults contpte_ptep_set_a… |
CVE-2026-42920 | High | 7.5 | 2026-05-13 | When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microker… |
CVE-2026-42781 | Medium | 6.5 | 2026-05-13 | When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Mana… |
CVE-2026-39806 | High | 7.5 | 2026-05-13 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhau… |
CVE-2026-44302 | High | 7.5 | 2026-05-12 | Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop… |
CVE-2026-42899 | High | 7.5 | 2026-05-12 | Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-34962 | Medium | 6.2 | 2026-05-11 | barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir()… |
CVE-2026-8318 | Medium | 5.3 | 2026-05-11 | A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a119577a1929decba. Affected by this vulnerability is the function toc_t… |
CVE-2026-4890 | High | 7.5 | 2026-05-11 | A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet. |
CVE-2026-7263 | High | 7.5 | 2026-05-10 | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the… |
CVE-2026-42310 | Medium | 5.5 | 2026-05-09 | Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefin… |
CVE-2026-41511 | Medium | 6.2 | 2026-05-08 | OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf… |
CVE-2026-29975 | High | 7.5 | 2026-05-08 | lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). The end-of-string detection logic incorrectly… |
CVE-2026-33814 | High | 7.5 | 2026-05-07 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a va… |
CVE-2026-43096 | Medium | 5.5 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: mshv: Fix infinite fault loop on permission-denied GPA intercepts Prevent infinite fault… |
CVE-2026-6536 | Medium | 5.5 | 2026-04-30 | DLMS/COSEM protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 |
CVE-2026-6534 | Medium | 5.5 | 2026-04-30 | USB HID protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6531 | Medium | 5.5 | 2026-04-30 | SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6528 | Medium | 5.5 | 2026-04-30 | TLS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 allows denial of service |
CVE-2026-6523 | Medium | 5.5 | 2026-04-30 | GNW protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6522 | Medium | 5.5 | 2026-04-30 | RPKI-Router protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6521 | Medium | 5.5 | 2026-04-30 | OpenFlow v5 protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6520 | Medium | 5.5 | 2026-04-30 | OpenFlow v6 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6519 | Medium | 5.5 | 2026-04-30 | MBIM protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-5407 | Medium | 5.5 | 2026-04-30 | SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-7375 | Medium | 5.5 | 2026-04-30 | UDS protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service |
CVE-2026-6985 | Medium | 5.3 | 2026-04-25 | A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the compone… |
CVE-2026-41680 | High | 7.5 | 2026-04-24 | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-b… |
CVE-2026-31642 | Medium | 5.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet->c… |
CVE-2026-31552 | High | 7.5 | 2026-04-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom Since ups… |
CVE-2026-31498 | Medium | 5.5 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop l2cap_config_req() proc… |
CVE-2026-31472 | Medium | 5.5 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: validate inner IPv4 header length in IPTFS payload Add validation of the inn… |
CVE-2026-31448 | Critical | 9.4 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping… |
CVE-2026-41146 | | 2026-04-22 | facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter an infinite loop whe… | |
CVE-2026-34282 | High | 7.5 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2026-41285 | Medium | 4.3 | 2026-04-21 | In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local networ… |
CVE-2026-28214 | Medium | 6.5 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function… |
CVE-2026-33116 | High | 7.5 | 2026-04-14 | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
CVE-2026-34852 | Medium | 6.1 | 2026-04-13 | Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-39934 | | 2026-04-07 | Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time… | |
CVE-2026-35406 | Medium | 6.2 | 2026-04-07 | Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset cause… |
CVE-2026-23472 | Medium | 5.5 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uar… |
CVE-2026-23451 | High | 7.5 | 2026-04-03 | In the Linux kernel, the following vulnerability has been resolved: bonding: prevent potential infinite loop in bond_header_parse() bond_header_parse() can l… |
CVE-2026-23409 | Medium | 5.5 | 2026-04-01 | In the Linux kernel, the following vulnerability has been resolved: apparmor: fix differential encoding verification Differential encoding allows loops to be… |
CVE-2026-33891 | High | 7.5 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulner… |
CVE-2026-33699 | High | 7.5 | 2026-03-27 | pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an in… |
CVE-2026-32287 | High | 7.5 | 2026-03-26 | Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage. This can be triggered by top-leve… |
CVE-2026-23298 | Medium | 5.5 | 2026-03-25 | In the Linux kernel, the following vulnerability has been resolved: can: ucan: Fix infinite loop from zero-length messages If a broken ucan device gets a mes… |
CVE-2026-4598 | High | 7.5 | 2026-03-23 | Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse im… |
CVE-2026-33013 | High | 7.5 | 2026-03-20 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 an… |
CVE-2026-32889 | Medium | 6.5 | 2026-03-20 | tinytag is a Python library for reading audio file metadata. Version 2.2.0 allows an attacker who can supply MP3 files for parsing to trigger a non-terminating… |
CVE-2026-32875 | High | 7.5 | 2026-03-20 | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or… |
CVE-2026-32873 | High | 7.5 | 2026-03-20 | ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared)… |
CVE-2025-71267 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST We found an infinite loop… |
CVE-2025-71266 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite lo… |
CVE-2025-71265 | Medium | 5.5 | 2026-03-18 | In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata We found an… |
CVE-2026-32256 | High | 7.5 | 2026-03-18 | music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/as… |
CVE-2026-30922 | High | 7.5 | 2026-03-18 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled rec… |
CVE-2026-4179 | Medium | 6.1 | 2026-03-16 | Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop. |