Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2021-39140
Summary
XStream is a simple library that serializes objects to XML and back again. In versions prior to 1.4.18, this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a Denial of Service only by manipulating the processed input stream. No user is affected, who followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 no longer uses a blacklist by default, since it cannot be secured for general purposes.
- HIGH
- NETWORK
- NONE
- CHANGED
- NONE
- LOW
- NONE
- HIGH
CWE-835 - Loop with Unreachable Exit Condition
Loops with multiple exits and flags detract from the quality of an application. They tend to make control structures difficult to understand, and introduce the risk of non-termination and other structural problems. The vulnerability “loop with unreachable exit condition” enables attackers to exploit this flaw, leading to denial of service.
References
Advisory Timeline
- Published