Skip to main content

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2025-29776

High
8.7/10

Summary

Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling "setTimer" in Azle versions 0.27.0-rc0 through 0.29.0 causes an immediate infinite loop of timers, with each timer attempting to clean up the global state of the previous one. The infinite loop will occur with any valid invocation of "setTimer". As a workaround, if a canister gets caught in this infinite loop after calling "setTimer", the canister can be upgraded, which will clear all the timers and end the loop.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-835 - Loop with Unreachable Exit Condition

Loops with multiple exits and flags detract from the quality of an application. They tend to make control structures difficult to understand, and introduce the risk of non-termination and other structural problems. The vulnerability “loop with unreachable exit condition” enables attackers to exploit this flaw, leading to denial of service.

References

Advisory Timeline

  • Published