CWE-835

{
  "affected": [],
  "aliases": [
    "CVE-2018-10546"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-29T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.",
  "id": "GHSA-2396-h4jp-vpjg",
  "modified": "2022-05-13T01:48:49Z",
  "published": "2022-05-13T01:48:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10546"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:2519"
    },
    {
      "type": "WEB",
      "url": "https://bugs.php.net/bug.php?id=76249"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201812-01"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20180607-0003"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3646-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4240"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/tns-2018-12"
    },
    {
      "type": "WEB",
      "url": "http://php.net/ChangeLog-5.php"
    },
    {
      "type": "WEB",
      "url": "http://php.net/ChangeLog-7.php"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/104019"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040807"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-42143"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-24T18:15:08Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.",
  "id": "GHSA-23p4-xxgc-xqvf",
  "modified": "2025-06-20T21:31:53Z",
  "published": "2024-01-24T18:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42143"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2024/Jan/16"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jan/16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-107677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-08T16:17:05Z",
    "severity": "MODERATE"
  },
  "details": "FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.",
  "id": "GHSA-23w5-87r9-849m",
  "modified": "2026-10-08T18:32:28Z",
  "published": "2026-10-08T18:32:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107677"
    },
    {
      "type": "WEB",
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e"
    },
    {
      "type": "WEB",
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592"
    },
    {
      "type": "WEB",
      "url": "https://ffmpeg.org"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-22654"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-29T15:15:29Z",
    "severity": "HIGH"
  },
  "details": "tcpreplay v4.4.4 was discovered to contain an infinite loop via the tcprewrite function at get.c.",
  "id": "GHSA-245w-hx5r-x6jq",
  "modified": "2025-05-30T15:30:30Z",
  "published": "2025-05-29T15:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22654"
    },
    {
      "type": "WEB",
      "url": "https://github.com/appneta/tcpreplay/issues/827"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/TimChan2001/4f25915b9952e8e3453db5cf72185b88"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tinytag"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104266"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:16:47Z",
    "nvd_published_at": "2026-10-15T18:17:22Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nAn M4A file containing a sub-atom with a size of zero in the `----` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.\n\n### Patches\nThe issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code path that contains appropriate size checks.\n\n### Workarounds\nNo workarounds exist. Users must upgrade to tinytag 2.3.0.",
  "id": "GHSA-24cc-9352-h2pg",
  "modified": "2026-10-15T20:16:47Z",
  "published": "2026-10-15T20:16:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tinytag/tinytag/security/advisories/GHSA-24cc-9352-h2pg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104266"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinytag/tinytag/pull/326"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinytag/tinytag/commit/9ada221ba44990cb02cd9002d992186e037b515e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tinytag/tinytag"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinytag/tinytag/releases/tag/2.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "tinytag: Infinite loop when parsing certain M4A files containing invalid atoms"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-46314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-08T17:16:50Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext-\u003enext == \u0026ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\n            return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector.",
  "id": "GHSA-24m2-rchh-h2mx",
  "modified": "2026-07-08T15:31:37Z",
  "published": "2026-06-08T18:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46314"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Pillow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "13.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-112391"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-21T21:11:07Z",
    "nvd_published_at": "2026-10-19T21:17:07Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n`PdfParser`\u0027s `get_value()` can recurse without any limit and crash with an uncaught `RecursionError`. It is reachable through `Image.save(im, fp=\u003cpdf\u003e, format=\"PDF\", append=True)` when the existing PDF file is attacker-controlled. This is the same class of bug as https://github.com/advisories/GHSA-r73j-pqj5-w3x7 (the /Prev trailer chain loop, fixed earlier this year), in the same file, but in two different functions that fix did not touch.\n\n### Details\n**`get_value()` in `src/PIL/PdfParser.py`**\n\nThis is a classmethod that takes `max_nesting: int = -1` and has a guard:\n\n```python\nif max_nesting == 0:\n    return None, None\n```\n\nEvery recursive call (nested arrays, dictionaries, indirect object definitions) passes `max_nesting=max_nesting - 1`. Since the default and every call site start at -1, this only ever counts down further negative: -1, -2, -3, and so on. It never equals exactly 0, so the guard never runs. A PDF object with a value nested a few thousand levels deep is enough to hit Python\u0027s recursion limit. It does not even need a valid `/Pages` tree, since `read_pdf_info()` parses the `/Root` object\u0027s own dictionary first, before checking anything else.\n\nThis advisory reports a single vulnerability: an ineffective recursion-depth guard in `PdfParser.get_value()` (the sentinel  `-1`  default never reaches the `== 0` check). The mention of GHSA-r73j-pqj5-w3x7 is comparative context for an already-fixed, already-CVE\u0027d bug in a different function \u2014 it is not a second vulnerability being reported. The three trigger paths (nested arrays/dicts/indirect objects) are not independently fixable; they share one root cause and one fix location in  get_value() .\n\n### Steps to reproduce\nBoth PDFs below are plain text, built directly in Python, no PDF library needed.\n\n```python\nfrom PIL.PdfParser import PdfParser\n\ndef build_pdf(root):\n    out = bytearray(b\"%PDF-1.4\\n\")\n    offset = len(out)\n    out += f\"1 0 obj\\n\".encode()\n    out += root\n    out += b\"\\nendobj\\n\"\n    out += b\"xref\\n\"\n    out += f\"0 2\\n\".encode()\n    out += b\"0000000000 65535 f \\n\"\n    out += f\"{offset:010d} 00000 \".encode() + b\"n \\n\"\n    xref_offset = len(out)\n    out += b\"xref\\n\"\n    out += f\"0 2\\n\".encode()\n    out += b\"0000000000 65535 f \\n\"\n    out += f\"{offset:010d} 00000 \".encode() + b\"n \\n\"\n    out += b\"trailer\\n\"\n    out += f\"\u003c\u003c /Size 2 /Root 1 0 R \u003e\u003e\\n\".encode()\n    out += b\"startxref\\n\"\n    out += f\"{xref_offset}\\n\".encode()\n    out += b\"%%EOF\"\n    return bytes(out)\n\nbomb = b\"[\" * 3000 + b\"]\" * 3000\nroot = b\"\u003c\u003c /Type /Catalog /Pages 2 0 R /Bomb \" + bomb + b\" \u003e\u003e\"\nwith open(\"nesting_bomb.pdf\", \"wb\") as f:\n    f.write(build_pdf(root))\n\nPdfParser(\"nesting_bomb.pdf\")     # raises RecursionError\n```\n\nExpected: a clean `PdfFormatError`.\n\nActual: raises a raw `RecursionError: maximum recursion depth exceeded`.\n\n### Impact\n- Availability: an attacker who controls the content of a PDF file that an application later appends an image page to (`Image.save(..., format=\"PDF\", append=True)`) can crash that request with a RecursionError, using a file of a few hundred bytes.\n- Confidentiality: none.\n- Integrity: none.\n- Pillow cannot open PDFs for reading through `Image.open()`. `PdfParser` is only reached through the append-mode save path, so the app has to be doing that specific thing (for example, stamping or watermarking an existing PDF) for this to matter.",
  "id": "GHSA-254f-3936-288h",
  "modified": "2026-10-21T21:11:07Z",
  "published": "2026-10-21T21:11:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112391"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-pillow/Pillow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ulikunitz/xz"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-29482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-24T17:52:22Z",
    "nvd_published_at": "2021-04-28T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nxz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.\n\n### Patches\n\nThe problem has been fixed in release v0.5.8.\n\n### Workarounds\n\nLimit the size of the compressed file input to a reasonable size for your use case.\n\n### References\n\nThe standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [xz](https://github.com/ulikunitz/xz/issues).",
  "id": "GHSA-25xm-hr59-7c27",
  "modified": "2024-05-31T17:45:58Z",
  "published": "2021-05-25T18:39:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ulikunitz/xz/issues/35"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2020-0016"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-109941"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-13T14:17:32Z",
    "severity": "HIGH"
  },
  "details": "FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads to loop forever and freeze the client decoder thread.",
  "id": "GHSA-26h4-ghv8-j876",
  "modified": "2026-10-13T15:32:22Z",
  "published": "2026-10-13T15:32:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7vfc-chg9-q5r8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109941"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/freerdp-2.3.0-before-3.32.0-infinite-loop-via-rd-gateway-chunked-response"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-33623"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-30T14:15:06Z",
    "severity": "LOW"
  },
  "details": "A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to a reboot. An attacker can send an HTTP request to trigger this vulnerability.",
  "id": "GHSA-276c-c7gr-r4j6",
  "modified": "2024-10-30T15:30:46Z",
  "published": "2024-10-30T15:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33623"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}