VYPR

CWE-834

Excessive Iteration

ClassIncomplete

Description

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.

Hierarchy (View 1000)

CVEs mapped to this weakness (112)

page 6 of 6
  • CVE-2023-5632HigOct 18, 2023
    risk 0.00cvss 7.5epss 0.01

    In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type…

  • CVE-2023-30226MedJul 12, 2023
    risk 0.00cvss 5.5epss 0.00

    An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.

  • CVE-2021-23270HigApr 12, 2021
    risk 0.00cvss 7.5epss 0.01

    In Gargoyle OS 1.12.0, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the…

  • CVE-2021-28950MedMar 20, 2021
    risk 0.00cvss 5.5epss 0.00

    An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1.

  • CVE-2020-35573HigDec 20, 2020
    risk 0.00cvss 7.5epss 0.03

    srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS address.

  • CVE-2020-25201HigNov 4, 2020
    risk 0.00cvss 7.5epss 0.03

    HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.

  • CVE-2019-12973MedJun 26, 2019
    risk 0.00cvss 5.5epss 0.03

    In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.

  • CVE-2019-3565HigMay 6, 2019
    risk 0.00cvss 7.5epss 0.03

    Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to…

  • CVE-2019-3559HigMay 6, 2019
    risk 0.00cvss 7.5epss 0.02

    Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue…

  • CVE-2019-3558HigMay 6, 2019
    risk 0.00cvss 7.5epss 0.02

    Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue…

  • CVE-2019-3552HigMay 6, 2019
    risk 0.00cvss 7.5epss 0.02

    C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service.…

  • CVE-2019-9547MedMar 1, 2019
    risk 0.00cvss 5.3epss 0.01

    In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target, because the vhost target did not properly…