Skip to content
BackEsc
Sign in

CWE-835 · weakness in Denial of Service

Loop with Unreachable Exit Condition

959 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
2
likely to be exploited
31

Every one of the 959 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe…CVE-2024-20353Cisco · CVSS 8.6 · 70% likely
  2. ProFTPD < 1.3.6b - Remote Unauthenticated DoSCVE-2019-1821720% likely
  3. FileZilla Server < 0.9.6 - DoS via MODE Z Infinite LoopCVE-2005-08512.2% likely
  4. The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid pay…CVE-2020-13935Apache Tomcat · 87% likely
  5. MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infi…CVE-2014-0050CVSS 7.5 · 83% likely
  6. A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.CVE-2020-3622777% likely
  7. Infinite loop in BN_mod_sqrt() reachable when parsing certificatesCVE-2022-0778OpenSSL · CVSS 7.5 · 73% likely
  8. HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.CVE-2019-1424170% likely
  9. The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vector…CVE-2017-1694463% likely
  10. Samba: infinite loop in mdssvc rpc service for spotlightCVE-2023-34966Red Hat · CVSS 7.5 · 62% likely
  11. lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a…CVE-2020-7046CVSS 7.5 · 51% likely
  12. Invalid handling of X509_verify_cert() internal errors in libsslCVE-2021-4044OpenSSL · 50% likely
  13. An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infin…CVE-2022-2383350% likely
  14. A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A sp…CVE-2019-5097EmbedThis · CVSS 5.3 · 45% likely
  15. An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.CVE-2024-50320Ivanti · CVSS 7.5 · 40% likely
  16. avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet t…CVE-2011-100229% likely
  17. Bitrix24 Denial-of-Service (DoS) via Improper File Stream AccessCVE-2023-1718Bitrix24 · CVSS 7.5 · 29% likely
  18. mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child proc…CVE-2004-074825% likely
  19. An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of serv…CVE-2023-45363CVSS 7.5 · 24% likely
  20. In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() functio…CVE-2017-1590824% likely
  21. qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a craft…CVE-2022-46770CVSS 7.5 · 23% likely
  22. An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with u…CVE-2021-20041SonicWall · 21% likely
  23. An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apac…CVE-2018-1336Apache Software Foundation · 20% likely
  24. aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Enco…CVE-2005-222418% likely
  25. A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lea…CVE-2022-0711haproxy · 17% likely
  26. The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a…CVE-2019-12402Apache Software Foundation · 16% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in