CWE-835: Infinite loop
1,055 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 1,055
- Last 12 months
- 338
- Critical
- 13
- Known exploited
- 1
Critical 13High 470Medium 543Low 27Not scored 2
CVEs per yearBy the year they were published
- 20141
- 201610
- 2017102
- 2018113
- 201955
- 202061
- 202180
- 202257
- 202363
- 202490
- 202574
- 2026333
Known exploitedNewest addition to KEV first
- CVE-2024-20353
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedHigh8.6
Newest CVEs
- CVE-2026-123607
Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Service
hickory-dns · hickory-dns
High8.7 - CVE-2026-123604
Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loop
hickory-dns · hickory-dns
High8.7 - CVE-2026-123964
OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loop
OpenBMB · Internet of Agents
Medium5.3 - CVE-2026-123785
Fluxbox through 1.3.7 Infinite Loop via Menu::updateMenu() Style Geometry
fluxbox · fluxbox
Medium6.8 - CVE-2026-123273
ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder
ImageMagick · ImageMagick
High7.1 - CVE-2026-110931
Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop
Red Hat · Red Hat build of Keycloak 26.4
High7.5 - CVE-2026-107602
Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop
Red Hat · Red Hat build of Keycloak 26.4
High7.5 - CVE-2026-33969
In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.
Samsung Semiconductor · Exynos 850
Not scored - CVE-2026-122305
Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loop
kyverno · kyverno
High8.3 - CVE-2026-97705
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
moleculerjs · moleculer
High7.5