CWE-606: Unchecked Input for Loop Condition

Définition

What is CWE-606?

This vulnerability occurs when an application fails to properly validate or limit user-supplied values that control loop iterations. Without these checks, malicious input can force the program into an endless or excessively long loop, consuming system resources and leading to denial of service or application instability.

At its core, this weakness allows an attacker to manipulate a program's flow by controlling how many times a loop executes. Common scenarios include using an unexpectedly large integer for a counter, a negative number that bypasses termination logic, or a specially crafted string that causes unexpected parsing behavior within the loop condition. Developers often trust these values from sources like configuration files, APIs, or user inputs without implementing strict bounds checking. To prevent this, always validate and sanitize any external input before it determines loop behavior. Implement explicit limits on maximum iterations, use signed/unsigned integer checks to prevent wrap-around issues, and consider adding timeout mechanisms for processing loops. Treat loop control variables with the same level of distrust as any other user input, as they directly control resource consumption and application availability.

Impact réel

Real-world CVEs caused by CWE-606

Aucune référence CVE publique n'est liée à ce CWE dans le catalogue MITRE pour le moment.

Comment les attaquants l'exploitent

Parcours de l'attaquant étape par étape

1
The following example demonstrates the weakness.
2
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
3
However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (CWE-606). If msgLength indicates a length that is longer than the size of a message body (CWE-130), then this can result in a buffer over-read by reading past the end of the buffer (CWE-126).

Exemple de code vulnérable

Vulnerable C

The following example demonstrates the weakness.

Vulnérable C

void iterate(int n){
  	int i;
  	for (i = 0; i < n; i++){
  		foo();
  	}
  }
  void iterateFoo()
  {
  	unsigned int num;
  	scanf("%u",&num);
  	iterate(num);
  }

Exemple de code sécurisé

Secure pseudo

Sécurisé pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Liste de contrôle de prévention

How to prevent CWE-606

Implementation Do not use user-controlled data for loop conditions.
Implementation Perform input validation.

Signaux de détection

How to detect CWE-606

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

CWE-606

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Questions fréquentes

Frequently asked questions

Qu'est-ce que CWE-606 ?

This vulnerability occurs when an application fails to properly validate or limit user-supplied values that control loop iterations. Without these checks, malicious input can force the program into an endless or excessively long loop, consuming system resources and leading to denial of service or application instability.

Quelle est la gravité de CWE-606 ?

MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.

Quels langages ou plateformes sont affectés par CWE-606 ?

MITRE n'a pas spécifié les plateformes affectées pour ce CWE — il peut s'appliquer à la plupart des stacks applicatives.

Comment puis-je prévenir CWE-606 ?

Do not use user-controlled data for loop conditions. Perform input validation.

Comment Plexicus détecte et corrige CWE-606 ?

Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-606 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.

Où puis-je en savoir plus sur CWE-606 ?

MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/606.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.

Faiblesses associées

Weaknesses related to CWE-606

CWE-1284 Parent

Improper Validation of Specified Quantity in Input

This vulnerability occurs when an application accepts user input meant to define a quantity—like a number, size, or count—but fails to…

CWE-834 Peut précéder

Excessive Iteration

This vulnerability occurs when a program runs a loop too many times because it lacks proper limits on its iterations.

Ressources

Prêt à valider ce qui compte.

Plexicus est Proof-Driven AppSec : findings validés, compréhension contextuelle et remédiation relue — ancrée dans la preuve, scopée avec vous.

Réserver un Pentest

Unchecked Input for Loop Condition