Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Calling `Task.yield/2` with a 0ms timeout performs a non-blocking check. When executed in a loop or recursive polling function without blocking or sleeping, it causes busy-spinning that exhausts BEAM scheduler CPU resources. Use `Task.yield_many/2` with a blocking timeout or an appropriate synchronization mechanism.
The route handler contains a polling loop with sleep() that lacks a timeout or maximum duration check. An attacker can supply parameters that prevent the loop exit condition from triggering, causing worker threads or connections to block indefinitely and exhausting server resources.
Method accepts an integer parameter defining loop bounds for mathematical expression evaluation without validating upper bounds, potentially leading to CPU exhaustion and Denial of Service.
Detected a lazy cache initialization using an inline loop that may be vulnerable to O(N*M) algorithmic complexity DoS if called repeatedly in an outer loop. Validate that the inner iteration over `$METHOD` is not an expensive operation, or that the resulting `$CACHE` is reused properly across all necessary invocations to avoid excessive continuous re-evaluat
Variable-Length Quantity (VLQ) decoding was found without an upper bound check. Processing unbounded ASN.1 tags, OIDs, or other base-128 varints can lead to excessive resource consumption (DoS) and integer conversion errors. Ensure that there is a limit on the number of iterations or the maximum value of the decoded integer.
Unbounded string splitting using `lastIndexOf` in a `while` loop without limiting the number of iterations can lead to Denial of Service (DoS) via resource exhaustion when handling inputs with excessive delimiters.
Setting RPC or network message limits (e.g., maxIhaveMessageIDs, maxMessages) to Infinity removes bounds-checking for excessive input. This unbounded configuration allows an attacker to send oversized payloads that trigger unbounded synchronous iteration or unbounded memory consumption, potentially blocking the event loop and leading to a Denial of Service (
An integer parsed from a dictionary is used as a loop bound without validation against a maximum or file size. An attacker could provide a maliciously large value in a crafted file, causing a Denial of Service (DoS) due to excessive resource consumption. Ensure the loop limit is capped relative to the physical data size using `min()` or explicit `>=` / `<=`
A potential Denial of Service (DoS) vulnerability exists where an array's length is arbitrarily expanded using unvalidated values from another array. A subsequent unbounded index-based `for` loop over this sparse array traverses all array empty slots (holes), potentially causing excessive CPU consumption and a blocked main thread. Validate integer bounds bef
A denial of service vulnerability exists due to an unbounded loop over unvalidated PDF sizes, or ReDoS in regex parsing xref/trailer data with overlapping whitespaces.
The application blindly trusts the user-supplied `/Size` value from the PDF trailer to determine the upper bound of a loop during `/Root` object recovery without enforcing a safe limit on the number of objects to check, leading to Denial of Service via prolonged CPU and resource usage.
Unbounded iteration from a sequence number up to a sequence number set's `base()`. In RTPS and DDS protocols, an attacker can craft a gap message with a huge difference between the start and base sequence numbers. This causes memory exhaustion (OOM) when arbitrary sequence numbers are inserted into internal states, or high CPU consumption due to massive O(N)
