CVE-2026-33969 is a vulnerability in the Samsung Semiconductor Exynos 850 chipset where a missing lower bound check during the NAS Authentication Request message decoding causes an infinite loop. This flaw can lead to a Denial of Service condition. A fix was released in October 2026.
Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.slice(length) to return the unchanged buffer while the while (packet.length > 0) loop continued indefinitely. The synchronous loop blocked the Node.js event loop and made every service in the process unresponsive until restart. The TCP transporter must be enabled and reachable, and neither CRC validation nor maxPacketSize prevents the malformed length value. This issue is fixed in versions 0.14.36 and 0.15.2.
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
CGI versions prior to 5.00 for Perl contain an infinite loop vulnerability triggered by a short request body when $DISABLE_UPLOADS is set. This occurs because the server reads until the declared Content-Length is reached, but if the actual body is shorter, the read returns zero repeatedly, causing the server process to hang indefinitely. This can be exploited by a client to keep a server process busy, potentially leading to denial of service.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
CVE-2026-120596 is a denial-of-service vulnerability in the Nut/Net TCP/IP stack used in Nut/OS by Ethernut/Egnite. The flaw allows an unauthenticated attacker to send a specially crafted TCP segment with an unknown TCP option length of zero, causing an infinite loop in the TCP options parser. This infinite loop blocks the TCP processing thread, making all TCP services on the device unresponsive until reboot. The vulnerability affects Nut/OS versions up to 5.1.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.
pypdf versions prior to 6.21.4 contain a vulnerability where cloning or duplicating a crafted cyclic DictionaryObject can cause an infinite loop. This occurs because the clone traversal checks generated destination references instead of the original source references, allowing some source cycles to bypass the visited-object check. The issue is fixed in version 6.21.4.
pypdf versions prior to 6.21.4 contain an infinite loop vulnerability triggered by processing a crafted incomplete PDF with a cross-reference table that ends without a trailer. This causes the parser to repeatedly rewind to the same position, blocking the processing thread. The issue is fixed in version 6.21.4.
An infinite loop vulnerability (CWE-835) exists in digitalbazaar's forge library versions prior to 1.4.1. The issue occurs in the BigInteger.prototype.modInverse() function when it receives a negative value or modulus, causing the Node.js event loop to block at full CPU. This can be triggered if an attacker controls the RSA public exponent passed to key generation or directly controls the modInverse() operand. Commonly parsed cryptographic formats like DER, PEM, JWK, PKCS#12, X.509, and TLS are not affected as they use unsigned values. The vulnerability is fixed in version 1.4.1.
CVE-2026-111731 is a high-severity vulnerability in RT-Labs P-Net versions before 1.0.3. The software enters an infinite loop when processing a specific read request for the PDPortDataCheck record with subslot 0, causing the device to stop responding. This can be exploited remotely without authentication to cause a denial of service.
CVE-2026-111496 is a critical integer overflow vulnerability in Apache Kafka Streams affecting versions from 1.1.0 through 4.1.2, 4.2.0 through 4.2.1, and 4.3.0 through 4.3.1. The flaw occurs when the stream-time punctuation calculation overflows due to record timestamps near Long.MAX_VALUE, causing the StreamThread to stall indefinitely. This results in the affected Streams application becoming unresponsive, though brokers and the cluster remain unaffected. The issue requires write access to a source topic using stream-time punctuation and is mitigated by Kafka broker settings that reject excessively large timestamps by default in version 4.0.0 and later. The vulnerability is fixed in Apache Kafka versions 4.2.2, 4.3.2, and 4.4.0.
CVE-2026-103410 is an integer overflow vulnerability in the DPI certificate scanner of Juniper Networks Session Smart Router. This flaw allows an unauthenticated remote attacker to cause a denial of service by sending a specially crafted TLS server certificate. The vulnerability affects multiple versions of the product prior to fixed releases. A fix is available in versions 7.0.5, 7.1.7, and 7.2.3.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.
CVE-2026-116774 is a resource consumption vulnerability in the Eugeny russh Rust SSH client and server library versions 0.60.0 through 0.64.x. The flaw allows an authenticated client or malicious server to cause asynchronous write operations to remain pending indefinitely by specifying a maximum_packet_size of zero. This leads to accumulation of affected tasks, channels, and connections without error, potentially exhausting resources. The issue is fixed in version 0.65.0.
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter a endless loop.
CVE-2026-116581 is a vulnerability in the lxsmnsyc seroval library prior to version 1.6.8. The flaw involves improper validation of a sequence node's done index in the fromJSON and fromCrossJSON functions, which can lead to an infinite loop. An attacker can exploit this by sending crafted input to a service that deserializes untrusted data, causing the event loop to block, exhausting process memory, or making the service unavailable. The issue is fixed in version 1.6.8.
CVE-2026-116671 is a low-severity vulnerability in Xpdf versions up to 4.06 that causes an infinite loop due to improper input validation of the progression order field in JPEG 2000 images.