Book a Security Review

Weakness · Medium

CWE-834: Excessive Iteration

What it is

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

MITRE CWE 4.19.1

Severity (our rating)
Medium
Likelihood of exploit
Not rated by MITRE
Introduced during
Implementation
Exploited in the wild
No CVE in CISA's catalog

In more detail

If the iteration can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory. In many cases, a loop does not need to be infinite in order to cause enough resource consumption to adversely affect the product or its host system; it depends on the amount of resources consumed per iteration.

What an attacker can do

  • DoS: Resource Consumption (CPU) (Availability)
  • DoS: Resource Consumption (Memory) (Availability)
  • DoS: Amplification (Availability)
  • DoS: Crash, Exit, or Restart (Availability)

How to prevent it

MITRE lists no specific mitigation for this weakness. Treat it like its parent weaknesses below: validate input, keep the design simple and review the code where it could appear.

How to find it

  • Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer Forced Path Execution
  • Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)
  • Automated Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Context-configured Source Code Weakness Analyzer
  • Architecture or Design Review. According to SOAR, the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

CWE-834 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.