Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,385

Export CSV
CVE-2025-20217

Cisco Firepower Threat Defense Intrusion Detection Denial of Service Vulnerability

A vulnerability in the packet inspection functionality of the Snort 3 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incorrect processing of traffic that is inspected by an affected device. An attacker could exploit this vulnerability by sending crafted traffic through the affected device. A successful exploit could allow the attacker to cause the affected device to enter an infinite loop while inspecting traffic, resulting in a DoS condition. The system watchdog will restart the Snort process automatically.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Firepower Threat Defense Software
CVE-2025-32029

ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation

ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule. Incorrect number DER encoding can lead to denial on service for absolute values in the range 2**31 -- 2**32 - 1. The arithmetic in the numBitLen didn't take into account that values in this range could result in a negative result upon applying the >> operator, leading to an infinite loop. The issue is patched in version 1.0.4. If upgrading is not an option, the issue can be mitigated by validating inputs to Asn1Integer to ensure that they are not smaller than -2**31 + 1 and no larger than 2**31 - 1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-20253

Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability

A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause an infinite loop that exhausts resources and could cause the device to reload.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Adaptive Security Appliance Software Firepower Threat Defense Software Ios and 2 more
CVE-2026-39934

Growth Experiments ReassignMenteesJob runs as an infinite loop

Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-growthexperiments Extension
CVE-2026-33891

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-34043

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yahoo
Products
Serialize Serialize-javascript
CVE-2025-13946

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2025-11626

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2024-4854

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Wireshark
Products
Fedora Wireshark
CVE-2024-11595

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

FiveCo RAP dissector infinite loop in Wireshark 4.4.0 to 4.4.1 and 4.2.0 to 4.2.8 allows denial of service via packet injection or crafted capture file

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2024-0211

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2023-4511

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-32875

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow or infinite loop through large indent handling. ujson.dumps() crashes the Python interpreter (segmentation fault) when the product of the indent parameter and the nested depth of the input exceeds INT32_MAX. It can also get stuck in an infinite loop if the indent is a large negative number. Both are caused by an integer overflow/underflow whilst calculating how much memory to reserve for indentation. And both can be used to achieve denial of service. To be vulnerable, a service must call ujson.dump()/ujson.dumps()/ujson.encode() whilst giving untrusted users control over the indent parameter and not restrict that indentation to reasonably small non-negative values. A service may also be vulnerable to the infinite loop if it uses a fixed negative indent. An underflow always occurs for any negative indent when the input data is at least one level nested but, for small negative indents, the underflow is usually accidentally rectified by another overflow. This issue has been fixed in version 5.12.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ultrajson Ultrajson Project
Products
Ultrajson Ultrajson
CVE-2026-33013

Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions prior to both 4.10.16 and 3.10.5 do not correctly handle descending array index order during form-urlencoded body binding in theJsonBeanPropertyBinder::expandArrayToThreshold, which allows remote attackers to cause a DoS (non-terminating loop, CPU exhaustion, and OutOfMemoryError) via crafted indexed form parameters (e.g., authors[1].name followed by authors[0].name). This issue has been fixed in versions 4.10.16 and 3.10.5.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Micronaut-projects Objectcomputing
Products
Micronaut-core Micronaut
CVE-2026-32256

music-metadata has an infinite loop vulnerability in ASF parser

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF parser (`parseExtensionObject()` in `lib/asf/AsfParser.ts:112-158`) enters an infinite loop when a sub-object inside the ASF Header Extension Object has `objectSize = 0`. Version 11.12.3 fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Borewit
Products
Music-metadata
CVE-2025-69647

binutils: infinite loop in readelf via crafted binary with malformed DWARF loclists data

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Binutils
CVE-2025-69648

binutils: infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Gnu
Products
Binutils
CVE-2025-58190

Infinite parsing loop in golang.org/x/net

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Go Golang
Products
Html Net