CWE-606 Base Draft

Unchecked Input for Loop Condition

Definition

What is CWE-606?

This vulnerability occurs when an application fails to properly validate or limit user-supplied values that control loop iterations. Without these checks, malicious input can force the program into an endless or excessively long loop, consuming system resources and leading to denial of service or application instability.

At its core, this weakness allows an attacker to manipulate a program's flow by controlling how many times a loop executes. Common scenarios include using an unexpectedly large integer for a counter, a negative number that bypasses termination logic, or a specially crafted string that causes unexpected parsing behavior within the loop condition. Developers often trust these values from sources like configuration files, APIs, or user inputs without implementing strict bounds checking. To prevent this, always validate and sanitize any external input before it determines loop behavior. Implement explicit limits on maximum iterations, use signed/unsigned integer checks to prevent wrap-around issues, and consider adding timeout mechanisms for processing loops. Treat loop control variables with the same level of distrust as any other user input, as they directly control resource consumption and application availability.

Auswirkungen in der Praxis

Real-world CVEs caused by CWE-606

Bisher sind in MITREs Katalog keine öffentlichen CVE-Referenzen mit dieser CWE verknüpft.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

1
The following example demonstrates the weakness.
2
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
3
However, the message length variable (msgLength) from the structure is used as the condition for ending the for loop without validating that msgLength accurately reflects the actual length of the message body (CWE-606). If msgLength indicates a length that is longer than the size of a message body (CWE-130), then this can result in a buffer over-read by reading past the end of the buffer (CWE-126).

Verwundbares Codebeispiel

Vulnerable C

The following example demonstrates the weakness.

Verwundbar C

void iterate(int n){
  	int i;
  	for (i = 0; i < n; i++){
  		foo();
  	}
  }
  void iterateFoo()
  {
  	unsigned int num;
  	scanf("%u",&num);
  	iterate(num);
  }

Sicheres Codebeispiel

Secure pseudo

Sicher pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Präventions-Checkliste

How to prevent CWE-606

Implementation Do not use user-controlled data for loop conditions.
Implementation Perform input validation.

Erkennungssignale

How to detect CWE-606

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Plexicus Auto-Fix

Plexicus erkennt CWE-606 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.

Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.

Demo anfordern Plexicus kostenlos testen

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-606?

Wie gravierend ist CWE-606?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-606 betroffen?

MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.

Wie kann ich CWE-606 verhindern?

Do not use user-controlled data for loop conditions. Perform input validation.

Wie erkennt und behebt Plexicus CWE-606?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-606 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-606?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/606.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-606

CWE-1284 Parent

Improper Validation of Specified Quantity in Input

This vulnerability occurs when an application accepts user input meant to define a quantity—like a number, size, or count—but fails to…

CWE-834 Kann vorausgehen

Excessive Iteration

This vulnerability occurs when a program runs a loop too many times because it lacks proper limits on its iterations.

Ressourcen

Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.

Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.

Kostenlos starten Demo buchen