Common Weakness Enumeration
CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1289 vulnerabilities reference this CWE, most recent first.
GHSA-XHJ5-RVCV-CCCG
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19
VLAI
Details
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
Severity
6.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2020-13800"
],
"database_specific": {
"cwe_ids": [
"CWE-674",
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-04T16:15:00Z",
"severity": "MODERATE"
},
"details": "ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.",
"id": "GHSA-xhj5-rvcv-cccg",
"modified": "2022-05-24T17:19:18Z",
"published": "2022-05-24T17:19:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13800"
},
{
"type": "WEB",
"url": "https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800"
},
{
"type": "WEB",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202011-09"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20200717-0001"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4467-1"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2020/06/04/2"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XHQG-MP7V-6MRP
Vulnerability from github – Published: 2022-02-10 00:01 – Updated: 2022-09-20 00:00
VLAI
Details
An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-23098"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-28T16:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.",
"id": "GHSA-xhqg-mp7v-6mrp",
"modified": "2022-09-20T00:00:32Z",
"published": "2022-02-10T00:01:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23098"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/network/connman/connman.git/log"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202310-21"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5231"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2022/01/25/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XHR3-WF7J-H255
Vulnerability from github – Published: 2024-10-15 21:30 – Updated: 2024-12-12 17:59
VLAI
Summary
Infinite loop in github.com/gomarkdown/markdown
Details
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion v0.0.0-20240729232818-a2a9c4f, which corresponds with commit a2a9c4f76ef5a5c32108e36f7c47f8d310322252, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit a2a9c4f76ef5a5c32108e36f7c47f8d310322252 contains fixes to this problem.
Severity
5.1 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gomarkdown/markdown"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20240729212818-a2a9c4f76ef5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-44337"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-16T14:09:50Z",
"nvd_published_at": "2024-10-15T20:15:21Z",
"severity": "MODERATE"
},
"details": "The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.",
"id": "GHSA-xhr3-wf7j-h255",
"modified": "2024-12-12T17:59:12Z",
"published": "2024-10-15T21:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44337"
},
{
"type": "WEB",
"url": "https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252"
},
{
"type": "WEB",
"url": "https://github.com/Brinmon/CVE-2024-44337"
},
{
"type": "PACKAGE",
"url": "https://github.com/gomarkdown/markdown"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3205"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Infinite loop in github.com/gomarkdown/markdown"
}
GHSA-XJ65-Q394-F9P2
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47
VLAI
Details
The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-9094"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-19T19:29:00Z",
"severity": "MODERATE"
},
"details": "The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted image.",
"id": "GHSA-xj65-q394-f9p2",
"modified": "2022-05-13T01:47:48Z",
"published": "2022-05-13T01:47:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9094"
},
{
"type": "WEB",
"url": "https://github.com/jsummers/imageworsener/issues/27"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98728"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XJH9-V7X6-24JW
Vulnerability from github – Published: 2026-10-02 23:16 – Updated: 2026-10-02 23:16
VLAI
Summary
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Details
Impact
Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array(256). A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop. An unauthenticated client can trigger this with a single small request. Applications that use @fastify/busboy to parse multipart/form-data, directly or through @fastify/multipart, are affected.
Patches
Fixed in version 3.2.1.
Workarounds
Validate the multipart boundary before parsing and reject any boundary longer than the RFC 2046 limit of 70 characters (for example at a reverse proxy or in an onRequest hook). Upgrading to 3.2.1 removes the issue.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@fastify/busboy"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-19484"
],
"database_specific": {
"cwe_ids": [
"CWE-1322",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-02T23:16:17Z",
"nvd_published_at": "2026-08-13T10:17:11Z",
"severity": "HIGH"
},
"details": "### Impact\n\nVersions of `@fastify/busboy` from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a `Uint8Array(256)`. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop. An unauthenticated client can trigger this with a single small request. Applications that use `@fastify/busboy` to parse multipart/form-data, directly or through `@fastify/multipart`, are affected.\n\n### Patches\n\nFixed in version 3.2.1.\n\n### Workarounds\n\nValidate the multipart boundary before parsing and reject any boundary longer than the RFC 2046 limit of 70 characters (for example at a reverse proxy or in an onRequest hook). Upgrading to 3.2.1 removes the issue.",
"id": "GHSA-xjh9-v7x6-24jw",
"modified": "2026-10-02T23:16:17Z",
"published": "2026-10-02T23:16:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19484"
},
{
"type": "WEB",
"url": "https://github.com/fastify/busboy/commit/632a237e7fb6b3b7a30e0de8fab2ee72ca5bf722"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/fastify/busboy"
},
{
"type": "WEB",
"url": "https://github.com/fastify/busboy/releases/tag/v3.2.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary"
}
GHSA-XJPG-R9JG-HHHF
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-20 15:32
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix error handling in pdsc_devcmd_wait
Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error:
-
FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handling is bypassed and stale status is returned. Check !running first and return -ENXIO.
-
Timeout: If a command times out, err is set to -ETIMEDOUT but then overwritten by pdsc_err_to_errno(status) which reads stale status. Return -ETIMEDOUT immediately after cleaning up.
Both errors now propagate to pdsc_devcmd_locked() which queues health_work for recovery.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-64148"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:56Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix error handling in pdsc_devcmd_wait\n\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n\n1. FW crash: If firmware stops running, the wait loop breaks early with\n running=false. The condition \"if ((!done || timeout) \u0026\u0026 running)\" is\n false, so error handling is bypassed and stale status is returned.\n Check !running first and return -ENXIO.\n\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\n overwritten by pdsc_err_to_errno(status) which reads stale status.\n Return -ETIMEDOUT immediately after cleaning up.\n\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery.",
"id": "GHSA-xjpg-r9jg-hhhf",
"modified": "2026-07-20T15:32:01Z",
"published": "2026-07-19T18:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64148"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XJPW-MC8F-P786
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2022-05-13 01:24
VLAI
Details
The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2015-8900"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-27T22:59:00Z",
"severity": "MODERATE"
},
"details": "The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.",
"id": "GHSA-xjpw-mc8f-p786",
"modified": "2022-05-13T01:24:55Z",
"published": "2022-05-13T01:24:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8900"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/commit/97aa7d7cfd2027f6ba7ce42caf8b798541b9cdc6"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1195260"
},
{
"type": "WEB",
"url": "http://trac.imagemagick.org/changeset/17845"
},
{
"type": "WEB",
"url": "http://trac.imagemagick.org/changeset/17846"
},
{
"type": "WEB",
"url": "http://www.imagemagick.org/discourse-server/viewtopic.php?f=3\u0026t=26929"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/02/26/13"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/06/06/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XMCH-89F7-F57M
Vulnerability from github – Published: 2025-08-19 18:31 – Updated: 2026-01-07 21:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent infinite loop in rt6_nlmsg_size()
While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place:
list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); }
This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list.
Restart the loop if f6i->fib6_nsiblings is zero.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-38588"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-19T17:15:36Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent infinite loop in rt6_nlmsg_size()\n\nWhile testing prior patch, I was able to trigger\nan infinite loop in rt6_nlmsg_size() in the following place:\n\nlist_for_each_entry_rcu(sibling, \u0026f6i-\u003efib6_siblings,\n\t\t\tfib6_siblings) {\n\trt6_nh_nlmsg_size(sibling-\u003efib6_nh, \u0026nexthop_len);\n}\n\nThis is because fib6_del_route() and fib6_add_rt2node()\nuses list_del_rcu(), which can confuse rcu readers,\nbecause they might no longer see the head of the list.\n\nRestart the loop if f6i-\u003efib6_nsiblings is zero.",
"id": "GHSA-xmch-89f7-f57m",
"modified": "2026-01-07T21:31:39Z",
"published": "2025-08-19T18:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38588"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XMX9-MMQW-JCW6
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-04-20 03:41
VLAI
Details
The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted wav file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-9258"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-27T06:29:00Z",
"severity": "HIGH"
},
"details": "The TDStretch::processSamples function in source/SoundTouch/TDStretch.cpp in SoundTouch 1.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted wav file.",
"id": "GHSA-xmx9-mmqw-jcw6",
"modified": "2025-04-20T03:41:30Z",
"published": "2022-05-13T01:47:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9258"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42389"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Jul/62"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XQ54-X54M-VCPX
Vulnerability from github – Published: 2024-12-05 15:31 – Updated: 2024-12-05 19:58
VLAI
Summary
Drupal core Denial of Service
Details
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "10.2.0"
},
{
"fixed": "10.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-11941"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-05T19:58:07Z",
"nvd_published_at": "2024-12-05T15:15:08Z",
"severity": "HIGH"
},
"details": "The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).\n\nSites that do not use the Comment module are not affected.",
"id": "GHSA-xq54-x54m-vcpx",
"modified": "2024-12-05T19:58:07Z",
"published": "2024-12-05T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11941"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2024-001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Drupal core Denial of Service"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.