CWE-606: Unchecked Input for Loop Condition
Base
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Consequences
- Availability: DoS: Resource Consumption (CPU)
How to prevent it
- Implementation: Do not use user-controlled data for loop conditions.
- Implementation: Perform input validation.
Recent advisories
- GHSA-7w5x-hrqm-74c2 — smol-toml: Denial of Service via malformed TOML documents
- GHSA-m93f-wj8c-rp8p — Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability
- GHSA-rhh3-jpg6-66xh — Mermaid radar diagrams are vulnerable to DoS
- GO-2026-5037 — Inefficient candidate hostname parsing in crypto/x509
- GHSA-685m-2w69-288q — protobuf.js: Denial of service through unbounded protobuf recursion
- GO-2026-4986 — Quadratic string concatentation in consumeComment in net/mail
- GO-2026-4918 — Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
- GHSA-5m6q-g25r-mvwx — Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
- GHSA-95h4-8mqc-4mpf — Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC
- GHSA-cvr6-37gx-v8wc — KaTeX's maxExpand bypassed by Unicode sub/superscripts
- GHSA-64fm-8hw2-v72w — KaTeX's maxExpand bypassed by `\edef`
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor