Synchronous Access of Remote Resource without Timeout
CWE-1088
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.5.
Latest Synchronous Access of Remote Resource without Timeout vulnerabilities
- 7.5 High severity
hMailServer: Synchronous Access of Remote Resource without Timeout
Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form
- 7.5 High severity
Net-SNMP: Uncontrolled Resource Consumption
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listene
- 7.5 High severity
BI Connector: Synchronous Access of Remote Resource without Timeout
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no overall time
- 7.5 High severity
h2oai/h2o-3: Synchronous Access of Remote Resource without Timeout
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending mu
- 7.5 High severity
aimhubio/aim: Synchronous Access of Remote Resource without Timeout
In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other