CWE-834 Excessive Iteration
Description
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-834 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-hjf4-fphr-2h65 | CVE-2026-81872 | MODERATE |
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full |
2026-09-29 | |
| GHSA-pg57-6jwg-q645 | CVE-2026-53493 | MODERATE |
Containerd has image-pull DoS via crafted OCI index graph amplification |
2026-09-25 | |
| GHSA-23w6-3w8w-8484 | CVE-2026-84310 | MODERATE |
pypdf: Possible long runtimes/large memory usage when retrieving outlines |
2026-09-01 | |
| GHSA-763m-79hh-57f2 | CVE-2026-84311 | MODERATE |
pypdf: Possible long runtimes/large memory usage when extracting XForm objects |
2026-09-01 | |
| GHSA-fwg2-594c-jp42 | CVE-2026-71852 | MODERATE |
pypdf: Possible long runtimes/large memory usage for large CID font width ranges |
2026-08-07 | |
| GHSA-m99w-x7hq-7vfj | CVE-2026-64641 | HIGH |
Next.js: Denial of Service in App Router using Server Actions |
2026-07-22 | |
| GHSA-p3vc-36g9-x9gr | CVE-2026-50171 | HIGH |
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) |
2026-07-15 | |
| GHSA-248m-82v9-q6g6 | CVE-2026-48156 | MODERATE |
pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams |
2026-06-12 | |
| GHSA-89c6-vpcj-7vj4 | CVE-2026-45680 | MODERATE |
OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU |
2026-06-09 | |
| GHSA-qj8w-gfj5-8c6v | CVE-2026-34043 | MODERATE |
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects |
2026-05-21 | |
| GHSA-2f25-pfq3-c7h8 | CVE-2023-49316 | HIGH | - |
Phpseclib needs guardrails on large binaryfield integers |
2026-05-08 |
| GHSA-jpr7-q523-hx25 | - | HIGH | - |
Duplicate Advisory: phpseclib vulnerable to denial of service |
2026-05-08 |
| GHSA-4pxv-j86v-mhcw | CVE-2026-41313 | MODERATE |
pypdf: Possible long runtimes for wrong size values in incremental mode |
2026-05-05 | |
| GHSA-jj6c-8h6c-hppx | CVE-2026-41168 | MODERATE |
pypdf has long runtimes for wrong size values in cross-reference and object streams |
2026-04-24 | |
| GHSA-mj87-hwqh-73pj | CVE-2026-40347 | MODERATE |
python-multipart affected by Denial of Service via large multipart preamble or epilogue data |
2026-04-24 | |
| GHSA-wgvp-vg3v-2xq3 | CVE-2026-27025 | MODERATE |
pypdf has possible long runtimes/large memory usage for large /ToUnicode streams |
2026-02-23 | |
| GHSA-vr63-x8vc-m265 | CVE-2025-62707 | MODERATE |
pypdf possibly loops infinitely when reading DCT inline images without EOF marker |
2025-10-23 | |
| GHSA-f8r4-mf27-rf7m | CVE-2025-56571 | HIGH |
Finance.js vulnerable to DoS via the IRR function’s depth parameter |
2025-10-06 | |
| GHSA-w275-m8cr-hf2v | CVE-2024-25144 | MODERATE |
Liferay Portal denial-of-service vulnerability |
2024-10-02 | |
| GHSA-j3p8-6mrq-6g7h | CVE-2023-29407 | MODERATE |
Golang TIFF decoder vulnerable to excessive CPU consumption |
2024-05-20 | |
| GHSA-496g-fr33-whrf | CVE-2020-25201 | HIGH |
Denial of service in HashiCorp Consul |
2024-01-31 | |
| GHSA-g8p6-p27c-52fx | CVE-2023-4043 | MODERATE |
Eclipse Parsson Denial of Service vulnerability |
2023-11-03 | |
| GHSA-pmw9-567p-68pc | CVE-2022-3616 | MODERATE |
OctoRPKI crashes when max iterations is reached |
2023-10-02 | |
| GHSA-pg75-v6fp-8q59 | CVE-2023-38200 | HIGH |
Keylime's registrar vulnerable to Denial-of-service attack via a single open connection |
2023-08-01 | |
| GHSA-rwrx-x2hw-9h5w | CVE-2023-26513 | HIGH |
Apache Sling Resource Merger has Excessive Iteration vulnerability |
2023-03-20 |