CWE-835 不可达退出条件的循环(无限循环) 类弱点 334 条 CVE 漏洞汇总,含 AI 中文分析。
CWE-835属于逻辑缺陷类漏洞,指程序包含无法到达退出条件的循环,导致无限执行。攻击者通常利用此缺陷发起拒绝服务攻击,通过触发无限循环耗尽服务器CPU资源或内存,使合法用户无法访问服务。开发者应避免此类问题,需确保循环变量在每次迭代中正确更新,并设置合理的边界检查或超时机制,保证循环最终能正常终止。
int processMessagesFromServer(char *hostaddr, int port) { ... int servsock; int connected; struct sockaddr_in servaddr; // create socket to connect to server servsock = socket( AF_INET, SOCK_STREAM, 0); memset( &servaddr, 0, sizeof(servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons(port); servaddr.sin_addr.s_addr = inet_addr(hostaddr); do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep tr
int processMessagesFromServer(char *hostaddr, int port) { ... // initialize number of attempts counter int count = 0; do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // increment counter count++; // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep trying to establish connection to the server // up to a maximum number of attempts } while (connected < 0 && count < MAX_ATTEMPTS); // close socket and return success or failure ... }
public boolean isReorderNeeded(String bookISBN, int rateSold) { boolean isReorder = false; int minimumCount = 10; int days = 0; // get inventory count for book int inventoryCount = inventory.getIventoryCount(bookISBN); // find number of days until inventory count reaches minimum while (inventoryCount > minimumCount) { inventoryCount = inventoryCount - rateSold; days++; } // if number of days within reorder timeframe // set reorder return boolean to true if (days > 0 && days < 5) { isReorder = true; } return isReorder; }
public boolean isReorderNeeded(String bookISBN, int rateSold) { ... // validate rateSold variable if (rateSold < 1) { return isReorder; } ... }
| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-15163 | Wireshark 资源管理错误漏洞 — Wireshark | 5.5 | Medium | 2026-07-08 |
| CVE-2026-59935 | pypdf 资源管理错误漏洞 — pypdf | - | - | 2026-07-08 |
| CVE-2026-59877 | protobufjs protobuf.js 资源管理错误漏洞 — protobuf.js | 5.3 | Medium | 2026-07-08 |
| CVE-2026-59874 | isaacs node-tar 资源管理错误漏洞 — node-tar | - | - | 2026-07-08 |
| CVE-2026-11352 | curl 资源管理错误漏洞 — curl | - | - | 2026-07-03 |
| CVE-2026-54886 | Erlang/OTP 资源管理错误漏洞 — OTP | 5.3 | Medium | 2026-07-02 |
| CVE-2026-6684 | ChaN FatFs 资源管理错误漏洞 — FatFs | 4.6 | Medium | 2026-07-01 |
| CVE-2026-14258 | dhcpcd project dhcpcd 资源管理错误漏洞 — Red Hat Enterprise Linux 10 | 6.5 | Medium | 2026-07-01 |
| CVE-2026-10642 | Zephyr 资源管理错误漏洞 — zephyr | 4.6 | Medium | 2026-06-24 |
| CVE-2026-54904 | ruby-concurrency concurrent-ruby 资源管理错误漏洞 — concurrent-ruby | 8.2 | High | 2026-06-24 |
| CVE-2026-54651 | pypdf 资源管理错误漏洞 — pypdf | - | - | 2026-06-22 |
| CVE-2026-54531 | pypdf 资源管理错误漏洞 — pypdf | - | - | 2026-06-22 |
| CVE-2026-54530 | pypdf 资源管理错误漏洞 — pypdf | - | - | 2026-06-22 |
| CVE-2026-48986 | mcdope pam_usb 资源管理错误漏洞 — pam_usb | 4.7 | Medium | 2026-06-18 |
| CVE-2026-55199 | libssh2 资源管理错误漏洞 — libssh2 | 5.9 | Medium | 2026-06-17 |
| CVE-2026-48733 | ImageMagick 安全漏洞 — ImageMagick | 4.7 | Medium | 2026-06-10 |
| CVE-2025-71329 | image-size 安全漏洞 — image-size | 7.5 | High | 2026-06-10 |
| CVE-2025-71330 | image-size 安全漏洞 — image-size | 7.5 | High | 2026-06-10 |
| CVE-2026-49495 | NSA Ghidra 安全漏洞 — ghidra | 5.5 | Medium | 2026-06-10 |
| CVE-2025-71319 | image-size 安全漏洞 — image-size | 7.5 | High | 2026-06-09 |
| CVE-2026-44186 | Apache HTTP Server 安全漏洞 — Apache HTTP Server | - | - | 2026-06-08 |
| CVE-2026-41150 | Mermaid 安全漏洞 — mermaid | - | - | 2026-05-29 |
| CVE-2026-10028 | glib 安全漏洞 — Red Hat Enterprise Linux 10 | 4.3 | Medium | 2026-05-28 |
| CVE-2026-49017 | OpenStack Swift 安全漏洞 — Swift | - | - | 2026-05-27 |
| CVE-2026-47066 | Hackney 安全漏洞 — hackney | - | - | 2026-05-25 |
| CVE-2026-32739 | libheif 安全漏洞 — libheif | 6.5 | Medium | 2026-05-19 |
| CVE-2026-42920 | F5 BIG-IP 安全漏洞 — BIG-IP | 7.5 | High | 2026-05-13 |
| CVE-2026-42781 | F5 BIG-IP 安全漏洞 — BIG-IP | 6.5 | Medium | 2026-05-13 |
| CVE-2026-39806 | Bandit 安全漏洞 — bandit | - | - | 2026-05-13 |
| CVE-2026-44302 | Snappier 安全漏洞 — Snappier | 7.5 | High | 2026-05-12 |
CWE-835(不可达退出条件的循环(无限循环)) 是常见的弱点类别,本平台收录该类弱点关联的 334 条 CVE 漏洞。