CWE-835 不可达退出条件的循环(无限循环) 类弱点 334 条 CVE 漏洞汇总,含 AI 中文分析。
CWE-835属于逻辑缺陷类漏洞,指程序包含无法到达退出条件的循环,导致无限执行。攻击者通常利用此缺陷发起拒绝服务攻击,通过触发无限循环耗尽服务器CPU资源或内存,使合法用户无法访问服务。开发者应避免此类问题,需确保循环变量在每次迭代中正确更新,并设置合理的边界检查或超时机制,保证循环最终能正常终止。
int processMessagesFromServer(char *hostaddr, int port) { ... int servsock; int connected; struct sockaddr_in servaddr; // create socket to connect to server servsock = socket( AF_INET, SOCK_STREAM, 0); memset( &servaddr, 0, sizeof(servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons(port); servaddr.sin_addr.s_addr = inet_addr(hostaddr); do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep tr
int processMessagesFromServer(char *hostaddr, int port) { ... // initialize number of attempts counter int count = 0; do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // increment counter count++; // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep trying to establish connection to the server // up to a maximum number of attempts } while (connected < 0 && count < MAX_ATTEMPTS); // close socket and return success or failure ... }
public boolean isReorderNeeded(String bookISBN, int rateSold) { boolean isReorder = false; int minimumCount = 10; int days = 0; // get inventory count for book int inventoryCount = inventory.getIventoryCount(bookISBN); // find number of days until inventory count reaches minimum while (inventoryCount > minimumCount) { inventoryCount = inventoryCount - rateSold; days++; } // if number of days within reorder timeframe // set reorder return boolean to true if (days > 0 && days < 5) { isReorder = true; } return isReorder; }
public boolean isReorderNeeded(String bookISBN, int rateSold) { ... // validate rateSold variable if (rateSold < 1) { return isReorder; } ... }
| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2025-20136 | Cisco Secure Firewall Adaptive Security Appliance和Cisco Secure Firewall Threat Defense 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 8.6 | High | 2025-08-14 |
| CVE-2025-7054 | quiche 安全漏洞 — quiche | 6.5AI | Medium AI | 2025-08-07 |
| CVE-2023-2593 | Linux kernel 安全漏洞 | 5.9 | Medium | 2025-07-30 |
| CVE-2025-8194 | CPython 安全漏洞 — CPython | 7.5 | High | 2025-07-28 |
| CVE-2024-58261 | sequoia-openpgp 安全漏洞 — sequoia | 2.9 | Low | 2025-07-27 |
| CVE-2025-53015 | ImageMagick 安全漏洞 — ImageMagick | 7.5 | High | 2025-07-14 |
| CVE-2025-53628 | cpp-httplib 安全漏洞 — cpp-httplib | 7.5AI | High AI | 2025-07-10 |
| CVE-2025-42954 | SAP NetWeaver Business Warehouse 安全漏洞 — SAP NetWeaver Business Warehouse (CCAW application) | 2.7 | Low | 2025-07-08 |
| CVE-2025-2962 | Zephyr 安全漏洞 — Zephyr | 8.2 | High | 2025-06-24 |
| CVE-2025-0673 | GitLab Enterprise Edition(EE)和GitLab Community Edition(CE) 安全漏洞 — GitLab | 7.5 | High | 2025-06-12 |
| CVE-2025-30145 | GeoServer 安全漏洞 — geoserver | 7.5 | High | 2025-06-10 |
| CVE-2025-3857 | ion-dotnet 安全漏洞 — Amazon Ion Dotnet | 7.5 | High | 2025-04-21 |
| CVE-2025-32947 | PeerTube 安全漏洞 | 7.5 | High | 2025-04-15 |
| CVE-2025-29918 | Suricata 安全漏洞 — suricata | 6.2 | Medium | 2025-04-10 |
| CVE-2025-32029 | ts-asn1-der 安全漏洞 — ts-asn1-der | 7.5AI | High AI | 2025-04-07 |
| CVE-2025-2838 | Silicon Gecko OS 安全漏洞 — Gecko OS | 6.5AI | Medium AI | 2025-03-26 |
| CVE-2024-10907 | FastChat 资源管理错误漏洞 — lm-sys/fastchat | 7.5 | - | 2025-03-20 |
| CVE-2024-10829 | DB-GPT 资源管理错误漏洞 — eosphoros-ai/db-gpt | 7.5 | - | 2025-03-20 |
| CVE-2024-10821 | Invoke 资源管理错误漏洞 — invoke-ai/invokeai | 7.5 | - | 2025-03-20 |
| CVE-2024-12704 | LlamaIndex 安全漏洞 — run-llama/llama_index | 7.5 | - | 2025-03-20 |
| CVE-2024-9340 | ZenML 资源管理错误漏洞 — zenml-io/zenml | 7.5 | - | 2025-03-20 |
| CVE-2025-29776 | Azle 安全漏洞 — azle | 7.5 | - | 2025-03-14 |
| CVE-2025-27497 | OpenDJ 安全漏洞 — OpenDJ | 7.5 | - | 2025-03-05 |
| CVE-2025-1695 | F5 NGINX Unit 安全漏洞 — NGINX Unit | 5.3 | Medium | 2025-03-04 |
| CVE-2024-6790 | ARM多款产品 安全漏洞 — Bifrost GPU Kernel Driver | 6.5 | - | 2025-02-03 |
| CVE-2025-0290 | GitLab Community Edition和GitLab Enterprise Edition 安全漏洞 — GitLab | 4.3 | Medium | 2025-01-28 |
| CVE-2025-23221 | Fedify 安全漏洞 — fedify | 5.4 | Medium | 2025-01-20 |
| CVE-2024-11941 | Drupal 安全漏洞 — Drupal Core | 7.5 | - | 2024-12-05 |
| CVE-2024-53980 | RIOT 安全漏洞 — RIOT | 6.5 | - | 2024-11-29 |
| CVE-2024-11612 | 7-Zip 安全漏洞 — 7-Zip | 7.5 | - | 2024-11-22 |
CWE-835(不可达退出条件的循环(无限循环)) 是常见的弱点类别,本平台收录该类弱点关联的 334 条 CVE 漏洞。