CWE-834: Excessive Iteration
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
A kind of CWE-691 Insufficient Control Flow Management.
From the CWE List. © The MITRE Corporation.
Newest
- vllm vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool 6.5 Medium
- py-pdf pypdf pypdf: Possible long runtimes for large xref table header limits 7.1 High
- apache software foundation couchdb Apache CouchDB: Replicator follows redirects indefinitely 0.6 Low
- dlbeer quirc quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search 6.8 Medium
- open-webui Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation 7.1 High
- imagemagick ImageMagick: Denial of service possible when parsing an XMP profile. 5.3 Medium
- apache software foundation thrift Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements 8.7 High
- containerd Containerd has image-pull DoS via crafted OCI index graph amplification 6.9 Medium
- gerrit Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review 8.7 High
- collective icalendar icalendar: Denial of service via unbounded VALARM REPEAT expansion 6.5 Medium
- radare radare2 radare2: Uncontrolled resource consumption in radare2 PEF loader 5.5 Medium
- open-telemetry opentelemetry-go OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full 6.3 Medium
- nvidia triton inference server NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause... 7.5 High
- py-pdf pypdf pypdf: Possible long runtimes/large memory usage when extracting XForm objects 4.8 Medium
- py-pdf pypdf pypdf: Possible long runtimes/large memory usage when retrieving outlines 4.8 Medium
- mesop-dev mesop Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server 8.7 High
- py-pdf pypdf pypdf: Possible long runtimes/large memory usage for large CID font width ranges 4.8 Medium
- bouncycastle bc-java MLS hash-ratchet honours arbitrary 32-bit generation counter from sender 8.7 High
- angular Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) 8.2 High
- py-pdf pypdf pypdf: Possible long runtimes for zero-only width values in cross-reference streams 5.1 Medium
- opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU 5.9 Medium
- py-pdf pypdf pypdf: Possible long runtimes for wrong size values in incremental mode 4.8 Medium
- fastapiexpert python-multipart Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data 5.3 Medium
- py-pdf pypdf pypdf has possible long runtimes for wrong size values in cross-reference and object streams 6.9 Medium
- yahoo serialize, serialize-javascript +1 more Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects 5.9 Medium
- py-pdf pypdf pypdf has possible long runtimes/large memory usage for large /ToUnicode streams 6.9 Medium
- tornadoweb tornado Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters 7.5 High
- vercel next.js Next.js: Denial of Service in App Router using Server Actions 8.2 High
- facebook proxygen Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in... 5.3 Medium
- py-pdf pypdf pypdf affected by possible infinite loop when reading DCT inline images without EOF marker 6.6 Medium
- ebradyjobory finance.js Finance.js vulnerable to DoS via the IRR function’s depth parameter 7.5 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections 7.5 High
- genivia gsoap gSOAP: Vulnerable to specially crafted unencrypted SDC messages 7.5 High
- progress telerik document processing libraries Telerik Document Processing Improper Handling of Memory Resources 6.5 Medium
- linux, linux kernel +1 more bpf: Add schedule points in batch ops 3.3 Low
- linux, linux kernel +1 more firmware: cs_dsp: Validate payload length before processing block 5.5 Medium
- linux, linux kernel +1 more ionic: use dev_consume_skb_any outside of napi 7.8 High
- openssl Excessive time spent checking DSA keys and parameters 5.3 Medium
- softaculous backuply, backuply – backup, restore, migrate and clone +1 more Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service 7.5 High
- liferay dxp, portal, digital experience platform +2 more Liferay Portal denial-of-service vulnerability 4.1 Medium
- phpseclib Phpseclib needs guardrails on large binaryfield integers 7.5 High
- eclipse parsson Parsson DoS when parsing numbers from untrusted sources 5.9 Medium
- eclipse mosquitto Unconditionally adding an event to the epoll causes excessive CPU consumption 7.5 High
- google grpc Denial-of-Service in gRPC 7.5 High
- golang image, golang.org/x/image golang.org/x/image/tiff, fedoraproject fedora +2 more Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff 6.5 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more Excessive time spent checking DH q parameter value 5.3 Medium
- keylime, fedoraproject fedora, red hat enterprise linux 9 +7 more +9 more Keylime: registrar is subject to a dos against ssl connections 7.5 High
- rizin An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0... 5.5 Medium
- wireshark, debian linux, fedoraproject fedora +2 more LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of... 6.3 Medium
- apache sling resource merger Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS 7.5 High
- Show olderLoading…