Skip to content
Log inStart free trial

CWE-834: Excessive Iteration

Class

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.

Consequences

  • Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Amplification, DoS: Crash, Exit, or Restart

Recent advisories

  • GHSA-542m-9234-8gvf — vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
  • GHSA-gmh7-3g9r-mjh5 — pypdf: Possible long runtimes for large xref table header limits
  • GHSA-pg57-6jwg-q645 — Containerd has image-pull DoS via crafted OCI index graph amplification
  • GHSA-763m-79hh-57f2 — pypdf: Possible long runtimes/large memory usage when extracting XForm objects
  • GHSA-23w6-3w8w-8484 — pypdf: Possible long runtimes/large memory usage when retrieving outlines
  • GHSA-fwg2-594c-jp42 — pypdf: Possible long runtimes/large memory usage for large CID font width ranges
  • GHSA-m99w-x7hq-7vfj — Next.js: Denial of Service in App Router using Server Actions
  • GHSA-248m-82v9-q6g6 — pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams
  • GHSA-4pxv-j86v-mhcw — pypdf: Possible long runtimes for wrong size values in incremental mode
  • GHSA-jj6c-8h6c-hppx — pypdf has long runtimes for wrong size values in cross-reference and object streams
  • GHSA-wgvp-vg3v-2xq3 — pypdf has possible long runtimes/large memory usage for large /ToUnicode streams
  • GHSA-vr63-x8vc-m265 — pypdf possibly loops infinitely when reading DCT inline images without EOF marker
  • GHSA-w275-m8cr-hf2v — Liferay Portal denial-of-service vulnerability
  • GHSA-496g-fr33-whrf — Denial of service in HashiCorp Consul

All advisories for CWE-834

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor