Unchecked Input for Loop Condition

Opis

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Skutki

• Availability

  DoS: Resource Consumption (CPU)

Zapobieganie

• Implementation

  Do not use user-controlled data for loop conditions.

• Implementation

  Perform input validation.

Przykłady podatności

• CVE-2025-32399 Chain: library for implementing Profinet devices does not check an input for a loop condition (CWE-606), allowing an infinite loop (CWE-835) via a crafted RPC packet

Słabość nadrzędna

• CWE-1284 Improper Validation of Specified Quantity in Input

Może prowadzić do

• CWE-834 Excessive Iteration

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 7, "Looping Constructs", Page 327, Addison Wesley, 2006
2. Automated Source Code Security Measure (ASCSM) — Object Management Group (OMG), ASCSM-CWE-606, 2016