CVE-2026-47863 is a medium severity vulnerability in Spring Reactor Core affecting versions 3.7.19 and earlier through 3.8.6. It involves an infinite loop condition triggered when using the Flux.bufferTimeout operator with fairBackpressure enabled, leading to a denial of service (DoS). No official patch or remediation guidance is currently available.
ORAS CLI versions up to and including 1.3.2 have a vulnerability where recursive referrer traversal does not track visited descriptors, allowing a malicious OCI registry to cause unbounded recursion and memory growth. This leads to client-side denial of service by exhausting CPU and memory resources, affecting commands like oras discover, backup, and restore. The issue is fixed in version 1.3.3.
OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an integer overflow vulnerability in the SampleCountChannel component. This flaw causes an infinite loop when the sample-list size is rounded up to the next power of two, due to a 32-bit unsigned integer wraparound. The issue can be triggered via public APIs by setting a pixel sample count to UINT_MAX. This vulnerability has been fixed in versions 3.2.10, 3.3.12, and 3.4.13.
CVE-2026-45271 is a medium severity vulnerability in the picotls TLS library used by the h2o project. It involves an infinite loop caused by a lack of maximum nesting depth enforcement in the ASN.1 validation helper used by the minicrypto backend when parsing local PKCS#8 private keys. This can lead to stack exhaustion and application crashes when processing attacker-supplied deeply nested ASN.1 structures. The OpenSSL backend is not affected. The issue has been fixed in a specific commit.
A vulnerability in django CMS versions prior to 5.0.8 allows a staff user with plugin-change permission to create a cycle in the plugin parent-child tree. This uncontrolled recursion can cause infinite database queries during plugin rendering, copying, or deletion, leading to resource exhaustion and corruption of the plugin tree. The issue is fixed in version 5.0.8.
A high-severity infinite loop vulnerability exists in the LiquidJS template engine versions 10.26.0 through 10.27.0. The issue occurs in the strip_html filter when processing input strings containing a '<' character with no corresponding closing '>'. This causes the template rendering to hang indefinitely, resulting in a denial of service. The vulnerability is fixed in version 10.27.1.
CVE-2026-17229 is a vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to cause a denial of service by triggering an infinite loop. This flaw is classified under CWE-835, which involves loops with unreachable exit conditions. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating it is exploitable over the network without privileges or user interaction and impacts availability.
Rsync versions 3.1.0 through 3.4.4 contain a signed integer overflow vulnerability in the I/O timeout implementation. This flaw allows attackers to send crafted MSG_IO_TIMEOUT messages with zero or negative values, causing the timeout variable to wrap and disable connection timeouts. As a result, idle or stalled connections can occupy daemon slots indefinitely, leading to resource exhaustion.
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack.
In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source - whether from a hardware fault, from the underlying DRBG being exhausted by contention across many cores, or from a hypervisor that does not provide the instruction - left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND, twice the baselines given in Intel's Digital Random Number Generator software implementation guide), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier so that a compiler cannot optimise the erase away as a dead store. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected.
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.
CVE-2026-71227 is a vulnerability in libkcapi version 0.12.0 and several subsequent versions where the _kcapi_aio_read_all() function can enter an infinite loop if an application reuses an Asynchronous Input/Output (AIO) enabled handle after a prior completion error. This flaw can cause a persistent denial of service by making the affected application or thread unresponsive. A fixed version 1.5.1-0.1.hum1 is available from Red Hat. Mitigation includes avoiding reuse of AIO-enabled handles after errors or disabling AIO if not needed.
CVE-2026-68499 is a vulnerability in the node-re2 package, which provides Node.js bindings for Google's RE2 regular expression engine. Versions prior to 1.25.2 have a flaw in the String.prototype.match implementation when using a global RE2 pattern that can match the empty string. This causes an infinite loop due to failure to advance the matching cursor, leading to unbounded native memory growth, blocking the event loop and potentially exhausting host memory. The issue is fixed in version 1.25.2.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.