Skip to main content

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2021-39140

Severity Medium
Score 6.3/10

Summary

XStream is a simple library that serializes objects to XML and back again. In versions prior to 1.4.18, this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a Denial of Service only by manipulating the processed input stream. No user is affected, who followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 no longer uses a blacklist by default, since it cannot be secured for general purposes.

  • HIGH
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-835 - Loop with Unreachable Exit Condition

Loops with multiple exits and flags detract from the quality of an application. They tend to make control structures difficult to understand, and introduce the risk of non-termination and other structural problems. The vulnerability “loop with unreachable exit condition” enables attackers to exploit this flaw, leading to denial of service.

Advisory Timeline

  • Published