Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7603e/src/mt7603_wifi/common modules). This vulnerability is associated with program files bn_lib.C.
This issue affects lede: through r25.10.1.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in coolsnowwolf lede (package/lean/mt/drivers/mt7615d/src/mt_wifi/embedded/security modules). This vulnerability is associated with program files bn_lib.C.
This issue affects lede: through r25.10.1.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in briandilley jsonrpc4j (src/main/java/com/googlecode/jsonrpc4j modules). This vulnerability is associated with program files NoCloseOutputStream.Java.
This issue affects jsonrpc4j: through 1.6.0.
CVE-2025-68137 is a high-severity buffer overflow vulnerability in the EVerest everest-core EV charging software stack. Prior to version 2025.10.0, an integer overflow in the SdpPacket::parse_header() function causes incorrect buffer length calculations, leading to either an infinite loop or a stack buffer overflow depending on the server configuration. This issue is fixed in version 2025.10.0.
CVE-2026-21905 is a high-severity vulnerability in Juniper Networks Junos OS affecting SRX Series and MX Series devices with MX-SPC3 or MS-MPC service cards. It involves an infinite loop triggered by malformed SIP messages over TCP, causing the flow management process to crash and resulting in a denial of service (DoS). The vulnerability requires no authentication or user interaction and affects multiple Junos OS versions prior to specific patched releases. SIP messages over UDP are not affected. Exploitation leads to a crash of critical processes (flowd or mspmand), disrupting network traffic handling. No known exploits are currently reported in the wild. European organizations relying on Juniper SRX or MX Series devices for network security and routing are at risk of service disruption. Mitigation requires timely patching to the fixed Junos OS versions. Network-level filtering of SIP TCP traffic and monitoring for anomalous SIP message patterns can reduce exposure. Countries with high adoption of Juniper infrastructure and critical telecom or enterprise networks are most likely impacted.
CVE-2026-21507 is a high-severity vulnerability in iccDEV versions prior to 2.3.1.1, caused by an infinite loop in the CalcProfileID function of IccProfile.cpp. This infinite loop results from an unreachable exit condition, leading to denial of service by exhausting CPU resources. The vulnerability does not impact confidentiality or integrity but severely affects availability. It requires no authentication or user interaction and can be exploited remotely via crafted ICC color profiles. European organizations using iccDEV for color management in imaging, printing, or graphic design software are at risk of service disruption. The issue is fixed in version 2.
CVE-2025-69227 is a medium severity vulnerability in aiohttp versions prior to 3.13.3 that can cause an infinite loop leading to a denial-of-service (DoS) attack. The flaw arises when Python optimizations are enabled (using -O or PYTHONOPTIMIZE=1), which bypass assert statements in aiohttp's handling of POST requests. An attacker can send a specially crafted POST request to trigger this infinite loop, causing the server to hang and become unresponsive. No authentication or user interaction is required, and the attack can be executed remotely over the network. This vulnerability affects asynchronous Python applications using aiohttp for HTTP client/server functionality. The issue is fixed in aiohttp version 3.13.3.
Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fails in status_contents.php causing DoS. Due to the fact that the unlink operation is done in a while loop; if an immutable file is specified or otherwise a file in which the process has no permissions to delete; it would repeatedly attempt to do in a loop.
### Summary
An attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests.
### Impact
An attacker can stop the application from serving requests after sending a single request.
-------
For anyone needing to patch older versions of aiohttp, the minimum diff needed to resolve the issue is (located in `_read_chunk_from_length()`):
```diff
diff --git a/aiohttp/multipart.py b/aiohttp/multipart.py
index 227be605c..71fc2654a 100644
--- a/aiohttp/multipart.py
+++ b/aiohttp/multipart.py
@@ -338,6 +338,8 @@ class BodyPartReader:
assert self._length is not None, "Content-Length required for chunked read"
chunk_size = min(size, self._length - self._read_bytes)
chunk = await self._content.read(chunk_size)
+ if self._content.at_eof():
+ self._at_eof = True
return chunk
async def _read_chunk_from_stream(self, size: int) -> bytes:
```
This does however introduce some very minor issues with handling form data. So, if possible, it would be recommended to also backport the changes in:
https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19
https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597
https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866
In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources.
CVE-2025-55118 is a high-severity heap-based buffer overflow vulnerability in BMC Control-M/Agent versions 9.0.18 through 9.0.22. It occurs when SSL/TLS communication is configured with specific non-default settings, allowing remote attackers to trigger memory corruption without authentication or user interaction. The vulnerability can lead to significant impacts on confidentiality, integrity, and availability of affected systems. Exploitation requires network access but no privileges, making it a critical concern for organizations using these versions with the specified configurations. No known exploits are currently in the wild, but the high CVSS score (8.4) indicates a serious risk.
Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames.
QUIC connections possess a set of connection identifiers (IDs); see Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#section-5.1 . Once the QUIC handshake completes, a local endpoint is responsible for issuing and retiring Connection IDs that are used by the remote peer to populate the Destination Connection ID field in packets sent from remote to local. Each Connection ID has a sequence number to ensure synchronization between peers.
An unauthenticated remote attacker can exploit this vulnerability by first completing a handshake and then sending a specially-crafted set of frames that trigger a connection ID retirement in the victim. When the victim attempts to send a packet containing RETIRE_CONNECTION_ID frames, Section 19.16 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#section-19.6 requires that the sequence number of the retired connection ID must not be the same as the sequence number of the connection ID used by the packet. In other words, a packet cannot contain a frame that retires itself. In scenarios such as path migration, it is possible for there to be multiple active paths with different active connection IDs that could be used to retire each other. The exploit triggered an unintentional behaviour of a quiche design feature that supports retirement across paths while maintaining full connection ID synchronization, leading to an infinite loop.This issue affects quiche: from 0.15.0 before 0.24.5.
CVE-2025-8194 is a high severity vulnerability in the Python Software Foundation's CPython implementation affecting the tarfile module. The flaw causes the TarFile extraction and entry enumeration APIs to enter an infinite loop when processing tar archives with negative offsets. This results in deadlock during parsing of maliciously crafted tar files. The vulnerability affects specific CPython versions including 3.10.0 through 3.14.0a1. No official patch is listed, but a mitigation patch is available as a third-party workaround.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629.
SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on availability of the application, there is no impact on confidentiality and integrity.
CVE-2025-2962 is a denial-of-service vulnerability in the Zephyr RTOS DNS implementation caused by an infinite loop with an unreachable exit condition. This flaw can cause the affected system to become unresponsive due to resource exhaustion. It has a high severity score of 8.2 and impacts availability only, without affecting confidentiality or integrity.
OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block the whole web server. The vulnerability has been patched in version 1.11.2.