Common Weakness Enumeration
CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1150 vulnerabilities reference this CWE, most recent first.
GHSA-MQR3-725G-5QGW
Vulnerability from github – Published: 2022-05-17 02:01 – Updated: 2025-04-11 03:44
VLAI
Details
avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.
{
"affected": [],
"aliases": [
"CVE-2011-1002"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-02-22T19:00:00Z",
"severity": "MODERATE"
},
"details": "avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.",
"id": "GHSA-mqr3-725g-5qgw",
"modified": "2025-04-11T03:44:21Z",
"published": "2022-05-17T02:01:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1002"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2011:0436"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2011:0779"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2011-1002"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=667187"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65524"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65525"
},
{
"type": "WEB",
"url": "http://avahi.org/ticket/325"
},
{
"type": "WEB",
"url": "http://git.0pointer.de/?p=avahi.git%3Ba=commit%3Bh=46109dfec75534fe270c0ab902576f685d5ab3a6"
},
{
"type": "WEB",
"url": "http://git.0pointer.de/?p=avahi.git;a=commit;h=46109dfec75534fe270c0ab902576f685d5ab3a6"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055858.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/02/18/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/02/18/4"
},
{
"type": "WEB",
"url": "http://osvdb.org/70948"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43361"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43465"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43605"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43673"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/44131"
},
{
"type": "WEB",
"url": "http://ubuntu.com/usn/usn-1084-1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2011/dsa-2174"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:037"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:040"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/02/22/9"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0436.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0779.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/46446"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0448"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0499"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0511"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0565"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0601"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0670"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0969"
},
{
"type": "WEB",
"url": "http://xorl.wordpress.com/2011/02/20/cve-2011-1002-avahi-daemon-remote-denial-of-service"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MRX3-23H7-M29P
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23
VLAI
Details
net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.
{
"affected": [],
"aliases": [
"CVE-2010-3880"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-12-10T19:00:00Z",
"severity": "MODERATE"
},
"details": "net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.",
"id": "GHSA-mrx3-23h7-m29p",
"modified": "2022-05-13T01:23:45Z",
"published": "2022-05-13T01:23:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3880"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=651264"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=22e76c849d505d87c5ecf3d3e6742a65f0ff4860"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=22e76c849d505d87c5ecf3d3e6742a65f0ff4860"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2010/11/04/9"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2010/11/05/3"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42126"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42789"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42890"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/46397"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2010/dsa-2126"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc2"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0958.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0004.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-0007.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/520102/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/44665"
},
{
"type": "WEB",
"url": "http://www.spinics.net/lists/netdev/msg145899.html"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2011-0012.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0024"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MWCW-C2X4-8C55
Vulnerability from github – Published: 2024-12-09 03:30 – Updated: 2025-11-04 16:54
VLAI
Summary
Predictable results in nanoid generation when given non-integer values
Details
When nanoid is called with a fractional value, there were a number of undesirable effects:
- in browser and non-secure, the code infinite loops on while (size--)
- in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
- if the first call in node is a fractional argument, the initial buffer allocation fails with an error
Version 3.3.8 and 5.0.9 are fixed.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nanoid"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "5.0.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "nanoid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-55565"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-09T22:42:43Z",
"nvd_published_at": "2024-12-09T02:15:19Z",
"severity": "MODERATE"
},
"details": "When nanoid is called with a fractional value, there were a number of undesirable effects:\n\n1. in browser and non-secure, the code infinite loops on while (size--)\n2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled\n3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error\n\nVersion 3.3.8 and 5.0.9 are fixed.",
"id": "GHSA-mwcw-c2x4-8c55",
"modified": "2025-11-04T16:54:54Z",
"published": "2024-12-09T03:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55565"
},
{
"type": "WEB",
"url": "https://github.com/ai/nanoid/pull/510"
},
{
"type": "PACKAGE",
"url": "https://github.com/ai/nanoid"
},
{
"type": "WEB",
"url": "https://github.com/ai/nanoid/compare/3.3.7...3.3.8"
},
{
"type": "WEB",
"url": "https://github.com/ai/nanoid/releases/tag/5.0.9"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Predictable results in nanoid generation when given non-integer values"
}
GHSA-MXWM-W839-25WJ
Vulnerability from github – Published: 2022-05-13 01:42 – Updated: 2022-05-13 01:42
VLAI
Details
The ReadPESImage function in coders\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a crafted PES file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-11446"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-19T07:29:00Z",
"severity": "HIGH"
},
"details": "The ReadPESImage function in coders\\pes.c in ImageMagick 7.0.6-1 has an infinite loop vulnerability that can cause CPU exhaustion via a crafted PES file.",
"id": "GHSA-mxwm-w839-25wj",
"modified": "2022-05-13T01:42:21Z",
"published": "2022-05-13T01:42:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11446"
},
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/issues/537"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4019"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99964"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P28X-HJ68-7VFP
Vulnerability from github – Published: 2024-04-08 15:30 – Updated: 2024-04-08 16:46
VLAI
Summary
Ryu Infinite Loop vulnerability
Details
An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop).
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ryu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-28732"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-08T16:46:52Z",
"nvd_published_at": "2024-04-08T14:15:07Z",
"severity": "HIGH"
},
"details": "An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop).",
"id": "GHSA-p28x-hj68-7vfp",
"modified": "2024-04-08T16:46:52Z",
"published": "2024-04-08T15:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28732"
},
{
"type": "WEB",
"url": "https://github.com/faucetsdn/ryu/issues/188"
},
{
"type": "WEB",
"url": "https://gist.github.com/ErodedElk/1133d64dde2d92393a065edc9b243792"
},
{
"type": "PACKAGE",
"url": "https://github.com/faucetsdn/ryu"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Ryu Infinite Loop vulnerability"
}
GHSA-P2WX-23H7-P7R8
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50
VLAI
Details
In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-19108"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-08T08:29:00Z",
"severity": "MODERATE"
},
"details": "In Exiv2 0.26, Exiv2::PsdImage::readMetadata in psdimage.cpp in the PSD image reader may suffer from a denial of service (infinite loop) caused by an integer overflow via a crafted PSD image file.",
"id": "GHSA-p2wx-23h7-p7r8",
"modified": "2022-05-13T01:50:50Z",
"published": "2022-05-13T01:50:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19108"
},
{
"type": "WEB",
"url": "https://github.com/Exiv2/exiv2/issues/426"
},
{
"type": "WEB",
"url": "https://github.com/Exiv2/exiv2/pull/518"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2101"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00038.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4056-1"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P3PX-2XX5-XMGX
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-04-20 03:38
VLAI
Details
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-9461"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-06T21:29:00Z",
"severity": "MODERATE"
},
"details": "smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.",
"id": "GHSA-p3px-2xx5-xmgx",
"modified": "2025-04-20T03:38:32Z",
"published": "2022-05-13T01:47:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9461"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1950"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2338"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2778"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/864291"
},
{
"type": "WEB",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=12572"
},
{
"type": "WEB",
"url": "https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=10c3e3923022485c720f322ca4f0aca5d7501310"
},
{
"type": "WEB",
"url": "https://git.samba.org/?p=samba.git;a=commit;h=10c3e3923022485c720f322ca4f0aca5d7501310"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99455"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P4GW-2VRQ-J64Q
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2022-05-24 17:07
VLAI
Details
In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.
{
"affected": [],
"aliases": [
"CVE-2019-20421"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-27T05:15:00Z",
"severity": "HIGH"
},
"details": "In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop and hang, with high CPU consumption. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted file.",
"id": "GHSA-p4gw-2vrq-j64q",
"modified": "2022-05-24T17:07:27Z",
"published": "2022-05-24T17:07:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20421"
},
{
"type": "WEB",
"url": "https://github.com/Exiv2/exiv2/issues/1011"
},
{
"type": "WEB",
"url": "https://github.com/Exiv2/exiv2/commit/a82098f4f90cd86297131b5663c3dec6a34470e8"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00028.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4270-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4958"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-P4QW-7J9G-5H53
Vulnerability from github – Published: 2025-04-07 21:11 – Updated: 2025-04-08 17:49
VLAI
Summary
ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation
Details
Impact
Incorrect number DER encoding can lead to denial on service for absolute values in the range 2**31 -- 2**32 - 1. The arithmetic in the numBitLen didn't take into account that values in this range could result in a negative result upon applying the >> operator, leading to an infinite loop.
In addition, number encoding had a few other issues that resulted it in it not encoding values correctly.
Patches
The issue is patched in version 1.0.4. Users are recommended to upgrade as soon as possible.
Workarounds
If upgrading is not an option, the issue can be mitigated by validating inputs to Asn1Integer to ensure that they are not smaller than -2**31 + 1 and no larger than 2**31 - 1. Although Asn1Integer supports bigint inputs, some additional implementation issues make using bigint as a mitigation inviable, as it will result in incorrect values.
If upgrading is not an option and range checks are impractical or undesirable, input to Asn1Integer can be provided as a buffer to be used directly. Note that this requires computing the correct DER encoding externally.
References
N/A
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@apeleghq/asn1-der"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-32029"
],
"database_specific": {
"cwe_ids": [
"CWE-1335",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-07T21:11:19Z",
"nvd_published_at": "2025-04-07T21:15:42Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nIncorrect `number` DER encoding can lead to denial on service for absolute values in the range `2**31` -- `2**32 - 1`. The arithmetic in the `numBitLen` didn\u0027t take into account that values in this range could result in a negative result upon applying the `\u003e\u003e` operator, leading to an infinite loop.\n\nIn addition, `number` encoding had a few other issues that resulted it in it not encoding values correctly.\n\n### Patches\n\nThe issue is patched in version `1.0.4`. Users are recommended to upgrade as soon as possible.\n\n### Workarounds\n\nIf upgrading is not an option, the issue can be mitigated by validating inputs to `Asn1Integer` to ensure that they are not smaller than `-2**31 + 1` and no larger than `2**31 - 1`. Although `Asn1Integer` supports `bigint` inputs, some additional implementation issues make using `bigint` as a mitigation inviable, as it will result in incorrect values.\n\nIf upgrading is not an option and range checks are impractical or undesirable, input to `Asn1Integer` can be provided as a buffer to be used directly. Note that this requires computing the correct DER encoding externally.\n\n### References\n\nN/A",
"id": "GHSA-p4qw-7j9g-5h53",
"modified": "2025-04-08T17:49:39Z",
"published": "2025-04-07T21:11:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ApelegHQ/ts-asn1-der/security/advisories/GHSA-p4qw-7j9g-5h53"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32029"
},
{
"type": "WEB",
"url": "https://github.com/ApelegHQ/ts-asn1-der/commit/b2bc9032cbe19755d234a27d79e47a7e52993af8"
},
{
"type": "PACKAGE",
"url": "https://github.com/ApelegHQ/ts-asn1-der"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation"
}
GHSA-P4RV-2523-RG59
Vulnerability from github – Published: 2022-05-01 01:52 – Updated: 2022-05-01 01:52
VLAI
Details
FileZilla FTP server before 0.9.6, when using MODE Z (zlib compression), allows remote attackers to cause a denial of service (infinite loop) via certain file uploads or directory listings.
{
"affected": [],
"aliases": [
"CVE-2005-0851"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-05-02T04:00:00Z",
"severity": "MODERATE"
},
"details": "FileZilla FTP server before 0.9.6, when using MODE Z (zlib compression), allows remote attackers to cause a denial of service (infinite loop) via certain file uploads or directory listings.",
"id": "GHSA-p4rv-2523-rg59",
"modified": "2022-05-01T01:52:39Z",
"published": "2022-05-01T01:52:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0851"
},
{
"type": "WEB",
"url": "http://sourceforge.net/project/shownotes.php?group_id=21558\u0026release_id=314473"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/12865"
}
],
"schema_version": "1.4.0",
"severity": []
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.