CWE-606 循环条件输入未经检查 类弱点 35 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-606 属于输入验证缺陷，指程序未对用于循环条件的输入进行充分检查。攻击者通常通过构造恶意输入，触发无限循环或过度迭代，从而导致系统资源耗尽，引发拒绝服务攻击。开发者应避免直接使用不可信数据控制循环，需在循环前验证输入范围，或设置最大迭代次数上限，以确保程序逻辑的安全性与稳定性。
void iterate(int n){ int i; for (i = 0; i < n; i++){ foo(); } } void iterateFoo() { unsigned int num; scanf("%u",&num); iterate(num); }int processMessageFromSocket(int socket) { int success; char buffer[BUFFER_SIZE]; char message[MESSAGE_SIZE]; // get message from socket and store into buffer //Ignoring possibliity that buffer > BUFFER_SIZE if (getMessage(socket, buffer, BUFFER_SIZE) > 0) { // place contents of the buffer into message structure ExMessage *msg = recastBuffer(buffer); // copy message body into string for processing int index; for (index = 0; index < msg->msgLength; index++) { message[index] = msg->msgBody[index]; } message[index] = '\0'; // process message success = processMessage(message); } return success; }| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-107569 | hMailServer 循环条件未检查输入漏洞 — hMailServer | 7.5 | High | 2026-10-19 |
| CVE-2026-95394 | Wireshark 循环条件未检查输入漏洞 — Wireshark | 4.7 | Medium | 2026-09-29 |
| CVE-2026-16652 | Temporal Server 调度排除搜索致 CPU 高耗 — Temporal Server | 7.1 | High | 2026-09-21 |
| CVE-2026-93653 | Poppler SplashOutputDev 拒绝服务漏洞 — Red Hat Enterprise Linux 10 | 5.5 | Medium | 2026-09-18 |
| CVE-2026-85730 | Squirrel Chat smol-toml 输入验证错误漏洞 — smol-toml | 8.2 | High | 2026-09-04 |
| CVE-2026-13761 | Pegasystems Pega Infinity 输入验证错误漏洞 — Pega Infinity | 8.8 | High | 2026-08-28 |
| CVE-2026-16599 | GNU wget 输入验证错误漏洞 — wget | 5.1 | Medium | 2026-08-25 |
| CVE-2026-62901 | Microsoft .NET 输入验证错误漏洞 — .NET 10.0 runtime | 7.5 | High | 2026-08-11 |
| CVE-2026-71439 | mermaid-js mermaid 处理逻辑错误漏洞 — mermaid | 5.3 | Medium | 2026-08-06 |
| CVE-2026-20301 | Cisco IOS XE Software 输入验证错误漏洞 — Cisco IOS XE Software | 8.6 | High | 2026-08-05 |
| CVE-2026-67554 | Apache Qpid Proton Dotnet 输入验证错误漏洞 — Apache Qpid Proton Dotnet | - | - | 2026-08-05 |
| CVE-2026-68077 | Apache Qpid Broker-J 输入验证错误漏洞 — Apache Qpid Broker-J | - | - | 2026-08-05 |
| CVE-2026-66276 | Apache Qpid Proton-J 输入验证错误漏洞 — Apache Qpid Proton-J | - | - | 2026-08-05 |
| CVE-2026-55731 | LOYTEC LIP-ME20xC 输入验证错误漏洞 — LIP-ME20xC | 6.6 | Medium | 2026-07-24 |
| CVE-2026-33800 | Juniper Networks Junos OS 输入验证错误漏洞 — Junos OS | 6.5 | Medium | 2026-07-09 |
| CVE-2026-15172 | Wireshark 输入验证错误漏洞 — Wireshark | 5.5 | Medium | 2026-07-08 |
| CVE-2026-41986 | Huawei HarmonyOS 安全漏洞 — HarmonyOS | 2.4 | Low | 2026-06-09 |
| CVE-2026-5950 | ISC BIND 9 安全漏洞 — BIND 9 | 5.3 | Medium | 2026-05-20 |
| CVE-2026-0243 | Palo Alto Networks Prisma SD-WAN ION 安全漏洞 — Prisma SD-WAN ION | - | - | 2026-05-13 |
| CVE-2026-1519 | ISC BIND 9 安全漏洞 — BIND 9 | 7.5 | High | 2026-03-25 |
| CVE-2019-25624 | Pixarra Liquid Studio 安全漏洞 — Liquid Studio | 6.2 | Medium | 2026-03-23 |
| CVE-2026-27689 | SAP Supply Chain Management 安全漏洞 — SAP Supply Chain Management | 7.7 | High | 2026-03-10 |
| CVE-2026-23689 | SAP Supply Chain Management 安全漏洞 — SAP Supply Chain Management | 7.7 | High | 2026-02-10 |
| CVE-2025-43801 | Liferay Portal和Liferay DXP 安全漏洞 — Portal | 7.5AI | High AI | 2025-09-16 |
| CVE-2025-42930 | SAP Business Planning and Consolidation 安全漏洞 — SAP Business Planning and Consolidation | 6.5 | Medium | 2025-09-09 |
| CVE-2024-13931 | ABB多款产品 安全漏洞 — ASPECT-Enterprise | 7.2 | High | 2025-05-22 |
| CVE-2024-13930 | ABB多款产品 安全漏洞 — ASPECT-Enterprise | 4.9 | Medium | 2025-05-22 |
| CVE-2025-32399 | RT-Labs P-Net 安全漏洞 — P-Net | 5.3 | Medium | 2025-05-07 |
| CVE-2024-8508 | NLnet Unbound 安全漏洞 — Unbound | 5.3 | Medium | 2024-10-03 |
| CVE-2024-4603 | OpenSSL 安全漏洞 — OpenSSL | 7.5AI | High AI | 2024-05-16 |
CWE-606（循环条件输入未经检查） 是常见的弱点类别，本平台收录该类弱点关联的 35 条 CVE 漏洞。