CVE-2026-96418 is a medium severity vulnerability in Wireshark affecting versions 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. It involves an infinite loop in the TIFF protocol dissector that can cause a denial of service. The flaw arises from a loop with an unreachable exit condition, leading to resource exhaustion when processing crafted TIFF data. No confidentiality or integrity impact is reported. No known exploits are currently in the wild.
CVE-2026-95386 is a medium severity vulnerability in Wireshark versions 4.6.0 through 4.6.8. It involves an infinite loop in the TTL file parser due to a loop with an unreachable exit condition, which can cause a denial of service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability by potentially causing the application to hang or become unresponsive.
CVE-2026-81885 is a medium severity vulnerability in radare2 prior to version 6.2.0. The issue involves the NE relocation fixup-chain parser, which lacks iteration limits or cycle detection when processing relocation entries. An attacker can trigger a denial of service by opening a crafted NE executable that causes the parser to repeatedly allocate resources indefinitely, leading to excessive CPU and memory consumption. This vulnerability is fixed in radare2 version 6.2.0.
Net::IDN::Punycode versions before 2.590 for Perl contain a vulnerability in the encode_punycode function where malformed UTF-8 input can cause the process to hang, crash, or return incorrect labels. This occurs because the function does not validate that its input is well-formed UTF-8, leading to infinite loops or crashes depending on the Perl version and backend used. The issue affects direct calls to encode_punycode with attacker-supplied bytes; the decoder and documented conversion functions are not affected.
CVE-2026-82560 is a high-severity vulnerability in Pod::Text for Perl versions before 6.1.1. It involves an infinite loop triggered by formatting a POD document with deeply nested =over directives that cause the margin to reach zero width. This results in CPU and memory exhaustion as the formatting process never returns and the output grows uncontrollably.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track::init_sample_timing_table() compute a logical m_num_output_samples value that exceeds the uint32_t counters used by Track_Visual::decode_next_image_sample() and Track::get_next_sample_raw_data(). The resulting comparison can never reach the oversized output count, causing non-terminating decode or raw-sample loops and bypassing max_sequence_frames. The same sequence path repeatedly calls Box_stts::get_sample_duration() and allocates Chunk::m_sample_ranges and Track::m_presentation_timeline outside MemoryHandle accounting, allowing severe CPU and memory exhaustion from a small file. This issue is fixed in version 1.23.2.
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even
for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in version 0.19.0. A `MAX_PAGES` cap bounds the slice loop — halting it even for a `+inf` height — and non-finite layout heights are sanitized so they can no longer drive the loop. As a workaround, validate or constrain untrusted CSS (in particular `height` / `vh` on body-level elements) before passing HTML to fulgur.
ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume no input bytes and the buffer offset does not advance, but the parser can still allocate up to itemCount multiplied by extentCount objects without an allocation budget. A small malicious iloc box can therefore cause hundreds of megabytes of heap growth or exhaust system memory, terminating a Node.js process and denying service to web, desktop, or mobile applications that parse untrusted images. The zero field widths are valid ISO-BMFF values indicating absent fields, so the vulnerable parser must bound work rather than relying on offset advancement. The issue is fixed in version 4.41.1.
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py accept a peer-supplied send_pktsize value of zero. When channel data reaches SSHChannel._flush_send_buf in asyncssh/channel.py, the zero value causes each loop iteration to slice and remove zero bytes without reducing the send window, leaving the synchronous loop permanently true with no await point. A malicious SSH server can trigger the client path through SSH_MSG_CHANNEL_OPEN_CONFIRMATION before the first channel write, while an authenticated client can trigger the server path through SSH_MSG_CHANNEL_OPEN and freeze every current and future connection handled by the process. This vulnerability is fixed in 2.24.0.
HAPI FHIR versions prior to 6.9.12 contain an improper input validation vulnerability in the SHCParser component. This flaw can cause an infinite loop when processing specially crafted Smart Health Card JWTs with a 'zip' header set to 'DEF' and an empty or truncated raw-DEFLATE payload. The infinite loop can indefinitely pin a JVM worker thread, potentially exhausting all validation workers under concurrent requests. This issue is fixed in version 6.9.12.
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.
CVE-2026-80489 is a medium severity vulnerability in the GNU C Library (glibc) versions 2.3 through 2.44. It involves an infinite loop condition when converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, such as via iconv. The flaw occurs because the converter improperly handles certain two-code-point sequences when the output buffer is too small, causing the application to hang indefinitely. This affects only the EUC_JISX0213 character set, which is uncommon.
CVE-2026-77117 is a vulnerability in the GNU C Library (glibc) versions 2.3 through 2.44 involving an infinite loop during conversion of crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding. The issue arises when a SHIFT_JISX0213 sequence decodes to two code points but the output buffer only has room for the first, causing the converter to repeatedly emit a pending character without consuming further input, leading to application hang. This affects only the SHIFT_JISX0213 character set, which is uncommon.
CVE-2026-6554 is a high-severity vulnerability in libpcap's BPF interpreter where a crafted filter program or network packet can cause an infinite loop. The issue arises because the 'ja L' BPF instruction offset is treated as a signed integer for looping but lacks limits on loop iterations, leading to a potential denial of service.
smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote attacker to cause a denial of service due to an infinite loop.
CVE-2026-84309 is a medium severity vulnerability in the py-pdf pypdf library prior to version 6.16.0. It involves an infinite loop caused by a crafted PDF with a cyclic tree structure that triggers the TreeObject.insert_child function to follow /Next links indefinitely. This issue is resolved in pypdf version 6.16.0.
CVE-2026-82579 is an infinite loop vulnerability in the ash_ai tool of the ash-project. The vulnerability occurs when the tool loop processes model responses that result in an empty list after filtering, causing the loop to recurse indefinitely without advancing the conversation. This can lead to unbounded repeated model requests, potentially hanging the tool. The issue affects versions from 0.6.0 up to but not including 1.0.0.