CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1150 vulnerabilities reference this CWE, most recent first.
GHSA-GC74-G85R-W7X5
Vulnerability from github – Published: 2026-07-27 18:31 – Updated: 2026-07-31 21:31facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error flags, causing the calling loop to re-invoke the parser on the same buffer indefinitely, exhausting all workers and permanently disabling the server until manually restarted.
{
"affected": [],
"aliases": [
"CVE-2026-66730"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-27T17:16:42Z",
"severity": "HIGH"
},
"details": "facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error flags, causing the calling loop to re-invoke the parser on the same buffer indefinitely, exhausting all workers and permanently disabling the server until manually restarted.",
"id": "GHSA-gc74-g85r-w7x5",
"modified": "2026-07-31T21:31:50Z",
"published": "2026-07-27T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66730"
},
{
"type": "WEB",
"url": "https://github.com/theopaid/Infinite-Loop-DoS-in-facil.io-MIME-Parser"
},
{
"type": "WEB",
"url": "https://tpaidakis.com/writeups/facilio-parser-dos"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/facil-io-infinite-loop-dos-via-multipart-mime-body-parser"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GF7X-HG8H-X3GF
Vulnerability from github – Published: 2026-08-14 18:31 – Updated: 2026-08-14 18:31A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.
{
"affected": [],
"aliases": [
"CVE-2026-13002"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-14T16:16:49Z",
"severity": "MODERATE"
},
"details": "A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.",
"id": "GHSA-gf7x-hg8h-x3gf",
"modified": "2026-08-14T18:31:37Z",
"published": "2026-08-14T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13002"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-13002"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486360"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GFH2-7JG5-653P
Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2021-05-20 16:29docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/appc/docker2aci"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-8579"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-20T16:29:42Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "docker2aci \u003c= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.",
"id": "GHSA-gfh2-7jg5-653p",
"modified": "2021-05-20T16:29:42Z",
"published": "2022-02-15T01:57:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8579"
},
{
"type": "WEB",
"url": "https://github.com/appc/docker2aci/issues/203"
},
{
"type": "WEB",
"url": "https://github.com/appc/docker2aci/pull/204/commits/54331ec7020e102935c31096f336d31f6400064f"
},
{
"type": "WEB",
"url": "https://github.com/appc/docker2aci/releases/tag/v0.13.0"
},
{
"type": "WEB",
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8579"
},
{
"type": "WEB",
"url": "https://www.securityfocus.com/bid/93560"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service in docker2aci"
}
GHSA-GFVH-R99J-X28P
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of the HSR ring ports of the device. This effectively breaks the redundancy of the HSR ring. If the attacker can perform the same attack on a second device, the ring is broken into two parts (thus disrupting communication between devices in the different parts).
{
"affected": [],
"aliases": [
"CVE-2020-9307"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-11T21:15:00Z",
"severity": "MODERATE"
},
"details": "Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. An unauthenticated, adjacent attacker can cause an infinite loop on one of the HSR ring ports of the device. This effectively breaks the redundancy of the HSR ring. If the attacker can perform the same attack on a second device, the ring is broken into two parts (thus disrupting communication between devices in the different parts).",
"id": "GHSA-gfvh-r99j-x28p",
"modified": "2022-05-24T17:41:54Z",
"published": "2022-05-24T17:41:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9307"
},
{
"type": "WEB",
"url": "https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/12276-source/options/view"
},
{
"type": "WEB",
"url": "https://www.belden.com/security"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GFVQ-MXW3-MFQ3
Vulnerability from github – Published: 2023-10-03 06:30 – Updated: 2023-10-04 19:34Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "asyncua"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.96"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26151"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-04T14:19:07Z",
"nvd_published_at": "2023-10-03T05:15:50Z",
"severity": "HIGH"
},
"details": "Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet and as a result, the server will enter into an infinite loop and consume excessive memory.",
"id": "GHSA-gfvq-mxw3-mfq3",
"modified": "2023-10-04T19:34:19Z",
"published": "2023-10-03T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26151"
},
{
"type": "WEB",
"url": "https://github.com/FreeOpcUa/opcua-asyncio/issues/1013"
},
{
"type": "WEB",
"url": "https://github.com/FreeOpcUa/opcua-asyncio/pull/1039"
},
{
"type": "WEB",
"url": "https://github.com/FreeOpcUa/opcua-asyncio/commit/f6603daa34a93a658f0e176cb0b9ee5a6643b262"
},
{
"type": "WEB",
"url": "https://gist.github.com/artfire52/1540b234350795e0ecb4d672608dbec8"
},
{
"type": "PACKAGE",
"url": "https://github.com/FreeOpcUa/opcua-asyncio"
},
{
"type": "WEB",
"url": "https://github.com/FreeOpcUa/opcua-asyncio/releases/tag/v0.9.96"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/asyncua/PYSEC-2023-190.yaml"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-PYTHON-ASYNCUA-5673709"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "asyncua vulnerable to denial of service via infinite loop"
}
GHSA-GGGQ-J347-R3W6
Vulnerability from github – Published: 2025-03-27 15:31 – Updated: 2025-11-03 21:33In the Linux kernel, the following vulnerability has been resolved:
tee: optee: Fix supplicant wait loop
OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes more complicated when there is incorrect shutdown ordering of the supplicant process vs the OP-TEE client application which can eventually lead to system hang-up waiting for the closure of the client application.
Allow the client process waiting in kernel for supplicant response to be killed rather than indefinitely waiting in an unkillable state. Also, a normal uninterruptible wait should not have resulted in the hung-task watchdog getting triggered, but the endless loop would.
This fixes issues observed during system reboot/shutdown when supplicant got hung for some reason or gets crashed/killed which lead to client getting hung in an unkillable state. It in turn lead to system being in hung up state requiring hard power off/on to recover.
{
"affected": [],
"aliases": [
"CVE-2025-21871"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-27T14:15:48Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntee: optee: Fix supplicant wait loop\n\nOP-TEE supplicant is a user-space daemon and it\u0027s possible for it\nbe hung or crashed or killed in the middle of processing an OP-TEE\nRPC call. It becomes more complicated when there is incorrect shutdown\nordering of the supplicant process vs the OP-TEE client application which\ncan eventually lead to system hang-up waiting for the closure of the\nclient application.\n\nAllow the client process waiting in kernel for supplicant response to\nbe killed rather than indefinitely waiting in an unkillable state. Also,\na normal uninterruptible wait should not have resulted in the hung-task\nwatchdog getting triggered, but the endless loop would.\n\nThis fixes issues observed during system reboot/shutdown when supplicant\ngot hung for some reason or gets crashed/killed which lead to client\ngetting hung in an unkillable state. It in turn lead to system being in\nhung up state requiring hard power off/on to recover.",
"id": "GHSA-gggq-j347-r3w6",
"modified": "2025-11-03T21:33:13Z",
"published": "2025-03-27T15:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21871"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0180cf0373f84fff61b16f8c062553a13dd7cfca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/21234efe2a8474a6d2d01ea9573319de7858ce44"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3eb4911364c764572e9db4ab900a57689a54e8ce"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/70b0d6b0a199c5a3ee6c72f5e61681ed6f759612"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c0a9a948159153be145f9471435695373904ee6d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d61cc1a435e6894bfb0dd3370c6f765d2d12825d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ec18520f5edc20a00c34a8c9fdd6507c355e880f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fd9d2d6124c293e40797a080adf8a9c237efd8b8"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH28-WW79-7H4V
Vulnerability from github – Published: 2026-05-12 00:31 – Updated: 2026-07-18 03:31barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
{
"affected": [],
"aliases": [
"CVE-2026-34962"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-11T23:19:47Z",
"severity": "MODERATE"
},
"details": "barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.",
"id": "GHSA-gh28-ww79-7h4v",
"modified": "2026-07-18T03:31:04Z",
"published": "2026-05-12T00:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34962"
},
{
"type": "WEB",
"url": "https://github.com/barebox/barebox"
},
{
"type": "WEB",
"url": "https://github.com/barebox/barebox/releases/tag/v2026.04.0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/barebox-ext4-directory-parsing-infinite-loop-denial-of-service"
},
{
"type": "WEB",
"url": "https://y637f9qq2x.com/posts/barebox-sandbox-vulns"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GH4V-V2HH-G9M6
Vulnerability from github – Published: 2023-03-29 21:30 – Updated: 2023-04-06 15:30This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537 [with vendor rollup]. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. A crafted certificate can force the server into an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-17203.
{
"affected": [],
"aliases": [
"CVE-2022-37013"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-29T19:15:00Z",
"severity": "HIGH"
},
"details": "This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation OPC UA C++ Demo Server 1.7.6-537 [with vendor rollup]. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. A crafted certificate can force the server into an infinite loop. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-17203.",
"id": "GHSA-gh4v-v2hh-g9m6",
"modified": "2023-04-06T15:30:18Z",
"published": "2023-03-29T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37013"
},
{
"type": "WEB",
"url": "https://documentation.unified-automation.com/uasdkcpp/1.7.7/CHANGELOG.txt"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1029"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH88-3PXP-6FM8
Vulnerability from github – Published: 2022-01-21 23:39 – Updated: 2022-01-21 21:04The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "colors"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23567"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-21T21:04:45Z",
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers\u0027 controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i \u003c Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0",
"id": "GHSA-gh88-3pxp-6fm8",
"modified": "2022-01-21T21:04:45Z",
"published": "2022-01-21T23:39:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23567"
},
{
"type": "WEB",
"url": "https://github.com/Marak/colors.js/issues/285"
},
{
"type": "WEB",
"url": "https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640"
},
{
"type": "WEB",
"url": "https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18"
},
{
"type": "PACKAGE",
"url": "https://github.com/Marak/colors.js"
},
{
"type": "WEB",
"url": "https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-COLORS-2331906"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Infinite Loop in colors.js"
}
GHSA-GH8J-2PGF-X458
Vulnerability from github – Published: 2021-09-13 20:05 – Updated: 2024-10-26 18:35The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "rencode"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-40839"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-13T19:11:37Z",
"nvd_published_at": "2021-09-10T02:15:00Z",
"severity": "HIGH"
},
"details": "The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\\x2f\\x7f), enabling a remote attack that consumes CPU and memory.",
"id": "GHSA-gh8j-2pgf-x458",
"modified": "2024-10-26T18:35:18Z",
"published": "2021-09-13T20:05:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40839"
},
{
"type": "WEB",
"url": "https://github.com/aresch/rencode/pull/29"
},
{
"type": "WEB",
"url": "https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-gh8j-2pgf-x458"
},
{
"type": "PACKAGE",
"url": "https://github.com/aresch/rencode"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/rencode/PYSEC-2021-345.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY"
},
{
"type": "WEB",
"url": "https://pypi.org/project/rencode/#history"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2021/Sep/16"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211008-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Infinite Loop in rencode"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.