CVE-2017-16932

libxml2: Infinite recursion in parameter entities

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.

CVSS 3.1 · 7.5 High EPSS 6.5% KEV · Not listed

Vendors

Xmlsoft

Products

Libxml2

CVE-2016-10228

glibc: iconv program can hang when invoked with the -c option

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

CVSS 3.0 · 5.9 Medium EPSS 4.1% KEV · Not listed

Vendors

Gnu Redhat

Products

Glibc Enterprise Linux

CVE-2026-107695

FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-97688

urllib3: Chunked Deflate streaming can enter an infinite loop

urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Python Urllib3

Products

Urllib3 Urllib3

CVE-2026-107391

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Borewit

Products

Music-metadata

CVE-2026-104633

Gitea migration memory exhaustion from zero page size

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-98237

net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU. Break out when the next NDP offset is not larger than the current one. Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration. Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-106121

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Com.rabbitmq Rabbitmq Vmware

Products

Amqp-client Java-client Rabbitmq Java Client

CVE-2026-107696

FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c

FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-106164

Infinite Loop in Telerik Document Processing XLS Import

In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Telerik Document Processing Libraries

CVE-2026-107577

Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer

Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progressive Robot

Products

Hmailserver

CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed

Vendors

Apache Netapp Oracle and 1 more

Products

Xerces-j Active Iq Unified Manager Agile Engineering Data Management and 28 more

CVE-2021-41079

Apache Tomcat DoS with unexpected TLS packet

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 7.2% KEV · Not listed

Vendors

Apache Debian Netapp and 1 more

Products

Tomcat Debian Linux Management Services For Element Software And Netapp Hci and 3 more

CVE-2018-7167

nodejs: Denial of Service by calling Buffer.fill() or Buffer.alloc() with specially crafted parameters

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Nodejs Redhat

Products

Node.js Rhel Software Collections

CVE-2021-37714

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVSS 3.1 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Jsoup Netapp Oracle and 2 more

Products

Jsoup Management Services For Element Software And Netapp Hci Banking Trade Finance and 22 more

CVE-2020-13935

tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

CVSS 3.1 · 7.5 High EPSS 86.6% KEV · Not listed

Vendors

Apache Canonical Debian and 5 more

Products

Tomcat Ubuntu Linux Debian Linux and 20 more

CVE-2017-9233

expat: Inifinite loop due to invalid XML in external entity

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

CVSS 3.1 · 7.5 High EPSS 8.7% KEV · Not listed

Vendors

Debian Libexpat Project Python

Products

Debian Linux Libexpat Python

CVE-2026-103885

Apache Directory LDAP API: Denial of service via crafted telephone number values

Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a CPU core indefinitely when processing some badly crafted Telephone Numbers. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Directory Ldap Api

CVE-2026-95386

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-96418

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark