CVE-2026-115269 is a high-severity vulnerability in mtrudel bandit's HTTP/2 request body reader that allows an unauthenticated remote attacker to cause an infinite loop by sending specific WINDOW_UPDATE or empty SETTINGS frames. This keeps stream processes open indefinitely, potentially exhausting resources. The issue affects bandit versions from 1.4.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
CVE-2026-115774 is a vulnerability in the Twisted framework prior to version 26.10.0rc1. It involves an uncontrolled resource consumption issue triggered by a negative literal size in an authenticated IMAP SEARCH command. This causes the parser cursor to move below zero, leading to an infinite loop that freezes the single-threaded reactor. As a result, all IMAP connections and any SMTP or POP3 services hosted in the same process become unresponsive until the process is restarted. The issue is fixed in version 26.10.0rc1.
CVE-2026-66281 is a vulnerability in Silicon Labs EmberZNet versions 9.1.1 and earlier where a malformed Discover Attributes command can cause an infinite loop due to an unreachable exit condition. This issue affects only devices that have already joined the network and support manufacturer-specific clusters.
HAProxy versions prior to 3.4.6 contain an infinite loop vulnerability in the HTTP/1.1 chunked request parser. This flaw allows a remote unauthenticated attacker to cause a denial of service by exhausting CPU resources on worker threads. The affected threads remain at 100% CPU usage even after client disconnects and timeouts, potentially consuming all worker threads and requiring a process restart to recover.
CVE-2026-96642 is a high-severity vulnerability in the Python Pillow imaging library prior to version 13.0.0. The flaw exists in the TarIO initializer, which accepts a negative octal member size and causes a backward seek that loops on the same 512-byte header. This results in an infinite loop consuming a full CPU core when the requested member name does not match. This issue only occurs when applications directly use PIL.TarIO.TarIO instead of the standard Image.open() method. The vulnerability is fixed in Pillow version 13.0.0.
pypdf versions prior to 6.20.0 contain a vulnerability where processing a crafted incomplete PDF file that ends inside a standard cross-reference table can cause the library to enter an infinite loop. This issue is resolved in version 6.20.0.
CVE-2026-113793 is a medium severity vulnerability in the pypdf library prior to version 6.20.1. The issue involves an infinite loop triggered when removing an object from a crafted cyclic PDF tree, such as an outline item, which can block the current process. This flaw is fixed in version 6.20.1.
An infinite loop vulnerability exists in pypdf versions prior to 6.20.1. Specifically, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can cause the process to hang indefinitely. This issue is resolved in version 6.20.1.
Eclipse OpenJ9 versions prior to 0.63.0 contain an integer overflow vulnerability in the JITServer component. This flaw occurs when processing the initial 4-byte length field of an incoming TCP connection, causing an infinite loop that consumes full CPU on the compilation worker thread. An unauthenticated remote attacker can exploit this to exhaust the worker thread pool, resulting in a denial of service that halts compilation services for all connected JVM clients.
CVE-2026-92387 is a high-severity vulnerability in curl where a malicious FTP, IMAP, POP3, or SMTP server can cause libcurl to enter an infinite loop by omitting the final control-response line. This bypasses the configured transfer timeout mechanism and indefinitely blocks all concurrent transfers using the same multi-handle.
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.
CVE-2026-112406 is an infinite loop vulnerability in the python-pillow library's PDF parser component. Specifically, the flaw occurs in the PdfParser.rewrite_pages() function when processing a PDF file with a cyclic page tree /Parent reference. This causes the library to hang indefinitely at 100% CPU when appending an image to such a PDF using the append=True option. The issue affects Pillow versions from 5.1.0 up to but not including 13.0.0.
A recursion depth check in the PdfParser.get_value() method of python-pillow's Pillow library is ineffective due to a default parameter value of -1 that never triggers the recursion limit guard. This allows crafted PDF files with deeply nested objects to cause a RecursionError when appending an image to an existing PDF using Image.save(..., format="PDF", append=True). The issue affects Pillow versions from 5.1.0 up to but not including 13.0.0 and is fixed in version 13.0.0.
CVE-2026-112390 is an infinite loop vulnerability in the python-pillow library's MIC image plugin. It occurs when processing a crafted Microsoft Image Composer (MIC) file containing an embedded TIFF with three or more image file directories (IFDs). The flaw causes the n_frames property to loop indefinitely at 100% CPU without raising exceptions or increasing memory usage. This affects Pillow versions from 7.2.0 up to but not including 13.0.0 when the optional olefile package is installed. The issue was introduced in April 2020 and fixed in version 13.0.0.
CVE-2026-68906 is a high-severity out-of-bounds read vulnerability in the mz-automation libiec61850 library prior to version 1.6.2. It occurs in the parseUserInformation function when handling malformed AARE PDUs during association, leading to an infinite CPU loop or a one-byte out-of-bounds read that can cause process abort. The flaw is due to improper validation of a negative buffer position returned by BerDecoder_decodeLength. This issue is fixed in version 1.6.2.
CVE-2026-105273 is a high severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from inadequate validation of MP4 box sizes in the MP4Parser component, which can cause the parser to fail to make forward progress and repeatedly process the same malformed input. This results in a denial of service condition due to resource exhaustion or application hang.
CVE-2026-107621 is a high-severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The JPEGParser component can enter an infinite loop when processing a specially crafted or truncated JPEG stream, leading to a denial of service condition.
CVE-2026-104266 is a vulnerability in the Python library tinytag versions 2.0.0 through 2.2.x. It involves an infinite loop triggered by an M4A audio file containing a malformed sub-atom with a size of zero inside a ---- atom. This causes the metadata parser to repeatedly process the same location, resulting in a denial of service. The issue is fixed in tinytag version 2.3.0.
CVE-2026-102185 is an infinite loop vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. This flaw occurs during EVPN multihoming with preference-based designated-forwarder election and can be triggered remotely by an attacker. Exploitation leads to a denial of service condition by causing the affected process to hang indefinitely. The vulnerability has a high severity rating with a CVSS score of 7.5. Multiple versions of Junos OS and Junos OS Evolved are affected, spanning several release trains and variants. No known exploits are reported in the wild. No explicit patch or remediation information is provided in the input data.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar archive to cause a denial of service via a crafted GNU sparse member.
When erl_tar:extract/1,2 writes a member to disk, erl_tar:stream_to_file_loop/3 reads it in chunks of 65536 bytes by default. For a GNU sparse member whose sparse map ends before its real size, erl_tar:do_sparse_read/3 matches its trailing-hole clause before its zero-length clause. After the chunk is used up, the trailing-hole clause reads zero bytes, does not advance the position, and recurses forever. A 2048-byte archive keeps the extracting process and one scheduler busy until the process is killed. The {max_size, N} option prevents this only when N is below the real size of the member. Extraction with the memory option is not affected.
hex_core ships its own copy of erl_tar as hex_erl_tar, and Hex and rebar3 ship hex_core with prefixed module names (mix_hex_erl_tar and r3_hex_erl_tar). These copies contain the same code and do not call stdlib's erl_tar, so they are affected on any OTP version. OTP 28 is not affected, but an application running on OTP 28 is affected if it extracts archives through an affected version of hex_core, Hex or rebar3.
This issue affects OTP from OTP 29.0 before OTP 29.1.2, corresponding to rebar3 from 3.27.1 before 3.28.0, and stdlib from 8.0 before 8.1.1, and hex from 2.4.2 before 2.5.3; hex_core: from 0.14.0 before 0.20.1.