Description
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Potential Impact
Availability
DoS: Resource Consumption (CPU)
Demonstrative Examples
void iterate(int n){int i;for (i = 0; i < n; i++){foo();}}void iterateFoo(){unsigned int num;scanf("%u",&num);iterate(num);}int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;for (index = 0; index < msg->msgLength; index++) {message[index] = msg->msgBody[index];}message[index] = '\0';
// process message
success = processMessage(message);
}return success;
}Mitigations & Prevention
Do not use user-controlled data for loop conditions.
Perform input validation.
Detection Methods
- Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2025-32399 | Chain: library for implementing Profinet devices does not check an input for a loop condition (CWE-606), allowing an infinite loop (CWE-835) via a crafted RPC packet |
Related Weaknesses
Taxonomy Mappings
- Software Fault Patterns: SFP25 — Tainted input to variable
- OMG ASCSM: ASCSM-CWE-606 —
Frequently Asked Questions
What is CWE-606?
CWE-606 (Unchecked Input for Loop Condition) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
How can CWE-606 be exploited?
Attackers can exploit CWE-606 (Unchecked Input for Loop Condition) to dos: resource consumption (cpu). This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-606?
Key mitigations include: Do not use user-controlled data for loop conditions.
What is the severity of CWE-606?
CWE-606 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.