CWE-835 · Denial of Service
Loop with Unreachable Exit Condition
959CVEs
1exploited
2with a public check
31likely (EPSS 10%+)
SortMost likely exploited
959 CVEs with CWE-835 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-20353In CISA KEVExploitedA vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthe…Cisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 8.6 · 2024-04-24 | 8.6 | 70% | 2024-04-24 |
| CVE-2019-18217CheckProFTPD < 1.3.6b - Remote Unauthenticated DoSProftpd · Proftpd · 2019-10-21 | – | 20% | 2019-10-21 |
| CVE-2005-0851CheckFileZilla Server < 0.9.6 - DoS via MODE Z Infinite LoopFilezilla-Project · Filezilla Server · 2005-03-24 | – | 2.2% | 2005-03-24 |
| CVE-2020-13935The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid pay…Apache · Apache Tomcat · 2020-07-14 | – | 87% | 2020-07-14 |
| CVE-2014-0050MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infi…Apache · Commons Fileupload · CVSS 7.5 · 2014-03-28 | 7.5 | 83% | 2014-03-28 |
| CVE-2020-36227A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.Openldap · Openldap · 2021-01-25 | – | 77% | 2021-01-25 |
| CVE-2022-0778Infinite loop in BN_mod_sqrt() reachable when parsing certificatesOpenSSL · OpenSSL · CVSS 7.5 · 2022-03-15 | 7.5 | 73% | 2022-03-15 |
| CVE-2019-14241HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.Haproxy · Haproxy · 2019-07-23 | – | 70% | 2019-07-23 |
| CVE-2017-16944The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vector…Exim · Exim · 2017-11-25 | – | 63% | 2017-11-25 |
| CVE-2023-34966Samba: infinite loop in mdssvc rpc service for spotlightRed Hat · Red Hat Enterprise Linux 8 · CVSS 7.5 · 2023-07-20 | 7.5 | 62% | 2023-07-20 |
| CVE-2020-7046lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a…Dovecot · Dovecot · CVSS 7.5 · 2020-02-12 | 7.5 | 51% | 2020-02-12 |
| CVE-2021-4044Invalid handling of X509_verify_cert() internal errors in libsslOpenSSL · OpenSSL · 2021-12-14 | – | 50% | 2021-12-14 |
| CVE-2022-23833An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infin…Djangoproject · Django · 2022-02-03 | – | 50% | 2022-02-03 |
| CVE-2019-5097A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A sp…Embedthis · EmbedThis · CVSS 5.3 · 2019-12-03 | 5.3 | 45% | 2019-12-03 |
| CVE-2024-50320An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.Ivanti · Avalanche · CVSS 7.5 · 2024-11-12 | 7.5 | 40% | 2024-11-12 |
| CVE-2011-1002avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet t…Avahi · Avahi · 2011-02-22 | – | 29% | 2011-02-22 |
| CVE-2023-1718Bitrix24 Denial-of-Service (DoS) via Improper File Stream AccessBitrix24 · Bitrix24 · CVSS 7.5 · 2023-11-01 | 7.5 | 29% | 2023-11-01 |
| CVE-2004-0748mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child proc…Apache · Http Server · 2004-09-10 | – | 25% | 2004-09-10 |
| CVE-2023-45363An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of serv…Mediawiki · Mediawiki · CVSS 7.5 · 2023-10-09 | 7.5 | 24% | 2023-10-09 |
| CVE-2017-15908In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS NSEC resource record to trigger an infinite loop in the dns_packet_read_type_window() functio…Systemd Project · Systemd · 2017-10-26 | – | 24% | 2017-10-26 |
| CVE-2022-46770qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a craft…Linuxfoundation · Mirage Firewall · CVSS 7.5 · 2022-12-07 | 7.5 | 23% | 2022-12-07 |
| CVE-2021-20041An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with u…SonicWall · SonicWall SMA100 · 2021-12-08 | – | 21% | 2021-12-08 |
| CVE-2018-1336An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apac…Apache Software Foundation · Apache Tomcat · 2018-08-02 | – | 20% | 2018-08-02 |
| CVE-2005-2224aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Enco…Microsoft · Asp.net · 2005-07-12 | – | 18% | 2005-07-12 |
| CVE-2022-0711A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lea…Haproxy · haproxy · 2022-03-02 | – | 17% | 2022-03-02 |
| CVE-2019-12402The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a…Apache Software Foundation · Apache Commons Compress · 2019-08-29 | – | 16% | 2019-08-29 |
| CVE-2018-1041A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this flaw to cause denia…Red Hat, Inc. · jboss-remoting · 2018-02-15 | – | 16% | 2018-02-15 |
| CVE-2019-3833Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated atta…Openwsman Project · openwsman · CVSS 7.5 · 2019-03-14 | 7.5 | 15% | 2019-03-14 |
| CVE-2021-3737A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client scr…Python · python · CVSS 7.5 · 2022-03-04 | 7.5 | 13% | 2022-03-04 |
| CVE-2017-8871The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted…Gnome · Libcroco · 2017-06-12 | – | 13% | 2017-06-12 |
| CVE-2024-33623A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to a reboot. An attacker can…LevelOne · WBR-6012 · CVSS 3.7 · 2024-10-30 | 3.7 | 12% | 2024-10-30 |
| CVE-2022-23437Infinite loop within Apache XercesJ xml parserApache Software Foundation · Apache Xerces · 2022-01-24 | – | 12% | 2022-01-24 |
| CVE-2016-4970handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).Netty · Netty · 2017-04-13 | – | 11% | 2017-04-13 |
| CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 6129…Apache Software Foundation · Apache POI · CVSS 7.5 · 2018-01-29 | 7.5 | 10% | 2018-01-29 |
| CVE-2018-10546An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stre…Php · Php · 2018-04-29 | – | 9.8% | 2018-04-29 |
| CVE-2019-0205In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been pa…Apache · Apache Thrift · 2019-10-28 | – | 9.2% | 2019-10-28 |
| CVE-2016-6301The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP pack…Busybox · Busybox · CVSS 7.5 · 2016-12-09 | 7.5 | 9.0% | 2016-12-09 |
| CVE-2026-4890CVE-2026-4890dnsmasq · dnsmasq · CVSS 7.5 · 2026-05-11 | 7.5 | 8.8% | 2026-05-11 |
| CVE-2018-8002In PoDoFo 0.9.5, there exists an infinite loop vulnerability in PdfParserObject::ParseFileComplete() in PdfParserObject.cpp which may result in stack overflow. Remote attackers co…Podofo Project · Podofo · 2018-03-09 | – | 8.0% | 2018-03-09 |
| CVE-2020-7595xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.Xmlsoft · Libxml2 · CVSS 7.5 · 2020-01-21 | 7.5 | 7.8% | 2020-01-21 |
| CVE-2017-6056It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop. Th…Debian · Debian Linux · 2017-02-17 | – | 7.6% | 2017-02-17 |
| CVE-2021-33194golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.Golang · Go · 2021-05-26 | – | 7.5% | 2021-05-26 |
| CVE-2016-6817The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. Thi…Apache Software Foundation · Apache Tomcat · CVSS 7.5 · 2017-08-10 | 7.5 | 7.2% | 2017-08-10 |
| CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsjhy · jsoup · CVSS 7.5 · 2021-08-18 | 7.5 | 6.7% | 2021-08-18 |
| CVE-2018-20103An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to its…Haproxy · Haproxy · 2018-12-12 | – | 6.6% | 2018-12-12 |
| CVE-2017-9122The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.Libquicktime · Libquicktime · 2017-06-12 | – | 6.5% | 2017-06-12 |
| CVE-2018-12228An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted messag…Sangoma · Asterisk · 2018-06-12 | – | 6.5% | 2018-06-12 |
| CVE-2017-16932parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.Xmlsoft · Libxml2 · CVSS 7.5 · 2017-11-23 | 7.5 | 6.5% | 2017-11-23 |
| CVE-2018-17197A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.Apache Software Foundation · Apache Tika · 2018-12-24 | – | 6.1% | 2018-12-24 |
| CVE-2018-16789libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could ex…Shellinabox Project · Shellinabox · 2019-03-17 | – | 6.0% | 2019-03-17 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.