Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

CVEs (114)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-0175 1Google 1Android Jun 17, 2026 Jun 11, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In XMF_ReadNode of eas_xmf.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed...Show more In XMF_ReadNode of eas_xmf.c, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-126380818Show less
CVE-2020-0174 1Google 1Android Jun 17, 2026 Jun 11, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for...Show more In Parse_ptbl of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127313537Show less
CVE-2020-0172 1Google 1Android Jun 17, 2026 Jun 11, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for...Show more In Parse_art of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127312550Show less
CVE-2020-0171 1Google 1Android Jun 17, 2026 Jun 11, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for...Show more In Parse_lart of eas_mdls.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127313223Show less
CVE-2020-0170 1Google 1Android Jun 17, 2026 Jun 11, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In IMY_Event of eas_imelody.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed f...Show more In IMY_Event of eas_imelody.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127310810Show less
CVE-2020-0169 1Google 1Android Jun 17, 2026 Jun 11, 2020 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 In RTTTL_Event of eas_rtttl.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed f...Show more In RTTTL_Event of eas_rtttl.c, there is possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-123700383Show less
CVE-2020-8992 4Canonical LinuxNetapp+1 more 10Active Iq Unified Manager Cloud BackupData Availability Services+7 more Jun 17, 2026 Feb 14, 2020 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size.
CVE-2019-9376 1Google 1Android Jun 17, 2026 Sep 27, 2019 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 In Account of Account.java, there is a possible boot loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for ex...Show more In Account of Account.java, there is a possible boot loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Android; Versions: Android-9, Android-8.0, Android-8.1; Android ID: A-129287265.Show less
CVE-2019-12973 4Debian OpensuseOracle+1 more 5Database Server Debian LinuxLeap+2 more Jun 17, 2026 Jun 26, 2019 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is s...Show more In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.Show less
CVE-2019-3565 1Facebook 1Thrift Jun 17, 2026 May 6, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take...Show more Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.05.06.00.Show less
CVE-2019-3564 1Facebook 1Thrift Jun 17, 2026 May 6, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse,...Show more Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.Show less
CVE-2019-3559 1Facebook 1Thrift Jun 17, 2026 May 6, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to pars...Show more Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.Show less
CVE-2019-3558 1Facebook 1Thrift Jun 17, 2026 May 6, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to pa...Show more Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.Show less
CVE-2019-3552 1Facebook 1Thrift Jun 17, 2026 May 6, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the se...Show more C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.Show less
CVE-2019-9547 1Spdk 1Storage Performance Development Kit Jun 17, 2026 Mar 1, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the S...Show more In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could carefully construct a circular descriptor chain that would result in a partial denial of service in the SPDK vhost target, because the vhost target did not properly detect such chains.Show less
CVE-2018-18651 1Xpdfreader 1Xpdf Nov 21, 2024 Oct 25, 2018 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by large loop) via a specific pdf file, as demonstrated by pdftohtml. This is mainly...Show more An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by large loop) via a specific pdf file, as demonstrated by pdftohtml. This is mainly caused by a large number after the /Count field in the file.Show less
CVE-2018-14342 2Debian Wireshark 2Debian Linux Wireshark Nov 21, 2024 Jul 19, 2018 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the BGP protocol dissector could go into a large loop. This was addressed in epan/dissectors/packet-bgp.c by validating Path Attribute lengths.
CVE-2018-11813 1Ijg 1Libjpeg Nov 21, 2024 Jun 6, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.
CVE-2018-11507 1Flif 1Flif Nov 21, 2024 May 28, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp.
CVE-2017-13279 1Google 1Android Nov 21, 2024 Apr 4, 2018 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 In M3UParser::parse of M3UParser.cpp, there is a memory resource exhaustion due to a large loop of pushing items into a vector. This could lead to remote denial of service with no additional execution privileges needed....Show more In M3UParser::parse of M3UParser.cpp, there is a memory resource exhaustion due to a large loop of pushing items into a vector. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68399439.Show less

Previous 1 2 345 6 Next