CWE-835 不可达退出条件的循环(无限循环) 类弱点 334 条 CVE 漏洞汇总,含 AI 中文分析。
CWE-835属于逻辑缺陷类漏洞,指程序包含无法到达退出条件的循环,导致无限执行。攻击者通常利用此缺陷发起拒绝服务攻击,通过触发无限循环耗尽服务器CPU资源或内存,使合法用户无法访问服务。开发者应避免此类问题,需确保循环变量在每次迭代中正确更新,并设置合理的边界检查或超时机制,保证循环最终能正常终止。
int processMessagesFromServer(char *hostaddr, int port) { ... int servsock; int connected; struct sockaddr_in servaddr; // create socket to connect to server servsock = socket( AF_INET, SOCK_STREAM, 0); memset( &servaddr, 0, sizeof(servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons(port); servaddr.sin_addr.s_addr = inet_addr(hostaddr); do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep tr
int processMessagesFromServer(char *hostaddr, int port) { ... // initialize number of attempts counter int count = 0; do { // establish connection to server connected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr)); // increment counter count++; // if connected then read and process messages from server if (connected > -1) { // read and process messages ... } // keep trying to establish connection to the server // up to a maximum number of attempts } while (connected < 0 && count < MAX_ATTEMPTS); // close socket and return success or failure ... }
public boolean isReorderNeeded(String bookISBN, int rateSold) { boolean isReorder = false; int minimumCount = 10; int days = 0; // get inventory count for book int inventoryCount = inventory.getIventoryCount(bookISBN); // find number of days until inventory count reaches minimum while (inventoryCount > minimumCount) { inventoryCount = inventoryCount - rateSold; days++; } // if number of days within reorder timeframe // set reorder return boolean to true if (days > 0 && days < 5) { isReorder = true; } return isReorder; }
public boolean isReorderNeeded(String bookISBN, int rateSold) { ... // validate rateSold variable if (rateSold < 1) { return isReorder; } ... }
| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-11595 | Wireshark 安全漏洞 — Wireshark | 7.8 | High | 2024-11-21 |
| CVE-2024-50321 | Ivanti Avalanche 安全漏洞 — Avalanche | 7.5 | High | 2024-11-12 |
| CVE-2024-50320 | Ivanti Avalanche 安全漏洞 — Avalanche | 7.5 | High | 2024-11-12 |
| CVE-2024-50319 | Ivanti Avalanche 安全漏洞 — Avalanche | 7.5 | High | 2024-11-12 |
| CVE-2024-11097 | SourceCodester Student Record Management System 安全漏洞 — Student Record Management System | 3.3 | Low | 2024-11-12 |
| CVE-2024-33623 | LevelOne WBR-6012 安全漏洞 — WBR-6012 | 3.7 | Low | 2024-10-30 |
| CVE-2024-43512 | Microsoft Windows Standards-Based Storage Management Service 安全漏洞 — Windows Server 2012 R2 | 6.5 | Medium | 2024-10-08 |
| CVE-2024-45395 | sigstore-go 安全漏洞 — sigstore-go | 3.1 | Low | 2024-09-04 |
| CVE-2024-8088 | Python 安全漏洞 — CPython | 6.5 | - | 2024-08-22 |
| CVE-2024-43366 | Vyper 安全漏洞 — era-compiler-vyper | 7.5 | High | 2024-08-15 |
| CVE-2024-42358 | PDFio 安全漏洞 — pdfio | 6.2 | Medium | 2024-08-06 |
| CVE-2024-23352 | Qualcomm Chipsets 安全漏洞 — Snapdragon | 7.5 | High | 2024-08-05 |
| CVE-2024-5569 | zipp 资源管理错误漏洞 — jaraco/zipp | 6.5 | - | 2024-07-09 |
| CVE-2024-6227 | Aim 资源管理错误漏洞 — aimhubio/aim | 7.5 | High | 2024-07-08 |
| CVE-2024-36990 | 部分Splunk产品 安全漏洞 — Splunk Enterprise | 6.5 | Medium | 2024-07-01 |
| CVE-2024-6061 | GPAC 安全漏洞 — GPAC | 3.3 | Low | 2024-06-17 |
| CVE-2024-5949 | Deep Sea Electronics DSE855 安全漏洞 — DSE855 | 6.5AI | Medium AI | 2024-06-13 |
| CVE-2023-50763 | 多款Siemens产品 安全漏洞 — SIMATIC CP 1542SP-1 | 4.9 | Medium | 2024-06-11 |
| CVE-2024-32976 | Envoy 安全漏洞 — envoy | 7.5 | High | 2024-06-04 |
| CVE-2024-4854 | Wireshark 安全漏洞 — Wireshark | 6.4 | Medium | 2024-05-14 |
| CVE-2024-32886 | Vitess 安全漏洞 — vitess | 4.9 | Medium | 2024-05-08 |
| CVE-2024-30251 | aiohttp 安全漏洞 — aiohttp | 7.5 | High | 2024-05-02 |
| CVE-2024-20353 | Cisco Firepower Threat Defense和Cisco Adaptive Security Appliance 安全漏洞 — Cisco Adaptive Security Appliance (ASA) Software | 8.6 | High | 2024-04-24 |
| CVE-2024-32650 | Rustls 安全漏洞 — rustls | 7.5 | High | 2024-04-19 |
| CVE-2024-2397 | tcpdump 安全漏洞 — tcpdump | 6.2 | Medium | 2024-04-12 |
| CVE-2024-24746 | Apache NimBLE 安全漏洞 — Apache NimBLE | 6.5 | - | 2024-04-06 |
| CVE-2024-29904 | CodeIgniter 安全漏洞 — CodeIgniter4 | 7.5 | High | 2024-03-29 |
| CVE-2024-21408 | Microsoft Hyper-V 安全漏洞 — Windows 10 Version 1809 | 5.5 | Medium | 2024-03-12 |
| CVE-2024-1931 | NLnet Labs Unbound 安全漏洞 — Unbound | 7.5 | High | 2024-03-07 |
| CVE-2024-25710 | Apache Commons Compress 安全漏洞 — Apache Commons Compress | 8.1 | High | 2024-02-19 |
CWE-835(不可达退出条件的循环(无限循环)) 是常见的弱点类别,本平台收录该类弱点关联的 334 条 CVE 漏洞。