Common Weakness Enumeration

CWE-834 Excessive Iteration

Description

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-834 ordered by modification date.

25 reviewed records
Advisory ID NVD ID Severity PURLs Summary Last Modified
GHSA-hjf4-fphr-2h65 CVE-2026-81872 MODERATE

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

2026-09-29
GHSA-pg57-6jwg-q645 CVE-2026-53493 MODERATE

Containerd has image-pull DoS via crafted OCI index graph amplification

2026-09-25
GHSA-23w6-3w8w-8484 CVE-2026-84310 MODERATE

pypdf: Possible long runtimes/large memory usage when retrieving outlines

2026-09-01
GHSA-763m-79hh-57f2 CVE-2026-84311 MODERATE

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

2026-09-01
GHSA-fwg2-594c-jp42 CVE-2026-71852 MODERATE

pypdf: Possible long runtimes/large memory usage for large CID font width ranges

2026-08-07
GHSA-m99w-x7hq-7vfj CVE-2026-64641 HIGH

Next.js: Denial of Service in App Router using Server Actions

2026-07-22
GHSA-p3vc-36g9-x9gr CVE-2026-50171 HIGH

@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

2026-07-15
GHSA-248m-82v9-q6g6 CVE-2026-48156 MODERATE

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

2026-06-12
GHSA-89c6-vpcj-7vj4 CVE-2026-45680 MODERATE

OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

2026-06-09
GHSA-qj8w-gfj5-8c6v CVE-2026-34043 MODERATE

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

2026-05-21
GHSA-2f25-pfq3-c7h8 CVE-2023-49316 HIGH -

Phpseclib needs guardrails on large binaryfield integers

2026-05-08
GHSA-jpr7-q523-hx25 - HIGH -

Duplicate Advisory: phpseclib vulnerable to denial of service

2026-05-08
GHSA-4pxv-j86v-mhcw CVE-2026-41313 MODERATE

pypdf: Possible long runtimes for wrong size values in incremental mode

2026-05-05
GHSA-jj6c-8h6c-hppx CVE-2026-41168 MODERATE

pypdf has long runtimes for wrong size values in cross-reference and object streams

2026-04-24
GHSA-mj87-hwqh-73pj CVE-2026-40347 MODERATE

python-multipart affected by Denial of Service via large multipart preamble or epilogue data

2026-04-24
GHSA-wgvp-vg3v-2xq3 CVE-2026-27025 MODERATE

pypdf has possible long runtimes/large memory usage for large /ToUnicode streams

2026-02-23
GHSA-vr63-x8vc-m265 CVE-2025-62707 MODERATE

pypdf possibly loops infinitely when reading DCT inline images without EOF marker

2025-10-23
GHSA-f8r4-mf27-rf7m CVE-2025-56571 HIGH

Finance.js vulnerable to DoS via the IRR function’s depth parameter

2025-10-06
GHSA-w275-m8cr-hf2v CVE-2024-25144 MODERATE

Liferay Portal denial-of-service vulnerability

2024-10-02
GHSA-j3p8-6mrq-6g7h CVE-2023-29407 MODERATE

Golang TIFF decoder vulnerable to excessive CPU consumption

2024-05-20
GHSA-496g-fr33-whrf CVE-2020-25201 HIGH

Denial of service in HashiCorp Consul

2024-01-31
GHSA-g8p6-p27c-52fx CVE-2023-4043 MODERATE

Eclipse Parsson Denial of Service vulnerability

2023-11-03
GHSA-pmw9-567p-68pc CVE-2022-3616 MODERATE

OctoRPKI crashes when max iterations is reached

2023-10-02
GHSA-pg75-v6fp-8q59 CVE-2023-38200 HIGH

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

2023-08-01
GHSA-rwrx-x2hw-9h5w CVE-2023-26513 HIGH

Apache Sling Resource Merger has Excessive Iteration vulnerability

2023-03-20