CWEweakness
CWE-606 Unchecked Input for Loop Condition
- Abstraction
- Base
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Common consequences
• Availability: DoS: Resource Consumption (CPU)
Potential mitigations
• [Implementation] Do not use user-controlled data for loop conditions.
• [Implementation] Perform input validation.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2025-32399: Chain: library for implementing Profinet devices does not check an input for a loop condition (CWE-606), allowing an infinite loop (CWE-835) via a crafted RPC packet
Related
Observed example · CVE (1)
- CVE-2025-32399 An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library… vulnerability
Can precede · CWE (1)
- CWE-834 Excessive Iteration weakness
Child of · CWE (1)
- CWE-1284 Improper Validation of Specified Quantity in Input weakness
Referenced by CVE · weakness (48)
- CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop… vulnerability
- CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop… vulnerability
- CVE-2026-95394 Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service vulnerability
- CVE-2026-16652 Temporal Server did not bound the work performed while searching for a Schedule's next action time. vulnerability
- CVE-2026-93653 A denial of service flaw was found in Poppler's Splash backend. vulnerability
- CVE-2026-85730 smol-toml is a small, fast, and correct TOML parser and serializer. vulnerability
- CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially… vulnerability
- CVE-2026-16599 GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. vulnerability
- CVE-2026-62901 Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. vulnerability
- CVE-2026-71439 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. vulnerability
- CVE-2026-20301 A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software… vulnerability
- CVE-2026-66276 An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range… vulnerability
- CVE-2026-67554 An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range… vulnerability
- CVE-2026-68077 An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range… vulnerability
- CVE-2026-55731 Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD… vulnerability
- CVE-2026-33800 An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows… vulnerability
- CVE-2026-15172 FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service vulnerability
- CVE-2026-11972 When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making… vulnerability
- CVE-2026-10143 kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or… vulnerability
- CVE-2026-41986 Logic bypass vulnerability in the file system. vulnerability
- CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. vulnerability
- CVE-2026-5950 An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling a remote… vulnerability
- CVE-2026-0243 A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network… vulnerability
- CVE-2026-42561 Python-Multipart is a streaming multipart parser for Python. vulnerability
- CVE-2026-44289 protobufjs compiles protobuf definitions into JavaScript (JS) functions. vulnerability
- CVE-2026-33814 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a… vulnerability
- CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory… vulnerability
- CVE-2026-41606 Uncontrolled Recursion vulnerability in Apache Thrift. vulnerability
- CVE-2026-33891 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. vulnerability
- CVE-2026-1519 If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. vulnerability
Referenced by CWE · has member (1)
- CWE-1340 CISQ Data Protection Measures view