# Infinite loop

An infinite loop (also called an endless loop) is a sequence of computer instructions that repeats indefinitely because the condition that would end the loop can never be reached. In software assurance the defect is cataloged as CWE-835, "Loop with Unreachable Exit Condition ('Infinite Loop')", a language-independent weakness whose main consequence is unexpected consumption of CPU cycles or memory.<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup>

| Key fact | Detail |
|---|---|
| Definition | A loop whose exit condition cannot be reached, so iteration never ends; CWE-835, base-level weakness, language-independent<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup> |
| Typical cause | The loop body never changes the tested variable, as when a counter is not incremented; MDN warns that any loop whose initializer is never updated "will go on forever"<sup>[2](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Scripting/Loops)</sup> |
| Security consequence | Denial of service through resource consumption (CPU, memory) and amplification; exploitable when an attacker can influence the loop<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup> |
| Common fix pattern | Bound the loop with a counter, for example limiting connection retries to a maximum number of attempts<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup> |
| Diagnosis in Java | A looping thread consumes all available CPU cycles; thread dumps taken with Control+\ or SIGQUIT, or the jstack utility, identify the looping RUNNABLE thread<sup>[3](https://docs.oracle.com/en/java/javase/15/troubleshoot/troubleshoot-process-hangs-and-loops.html)</sup> |
| Intentional use | Server and event loops run indefinitely by design; Python's asyncio `run_forever()` runs until `stop()` is called<sup>[4](https://docs.python.org/3.10/library/asyncio-eventloop.html)</sup> |
| Floating-point hazard | CERT rule FLP30-C: do not use floating-point variables as loop counters<sup>[5](https://wiki.sei.cmu.edu/confluence/spaces/flyingpdf/pdfpageexport.action?pageId=87152157)</sup> |

## How loops terminate, and how they fail to

Every general-purpose loop construct rests on the same three elements: setup before the loop, a condition checked on each pass, and some change to the state the condition tests. In a `while` loop the condition is evaluated before each iteration, and the body runs only while it is true; in a `do...while` loop the condition is checked after the body, so the body always runs at least once.<sup>[6](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/while)</sup><sup> • </sup><sup>[2](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Scripting/Loops)</sup> A `for` loop packages the same three parts in its header: an initializer run once, a condition checked before each iteration, and an iterator run after each iteration.<sup>[7](https://learn.microsoft.com/en-us/dotnet/csharp/fundamentals/statements/iteration)</sup>

An infinite loop arises when the third element is missing or ineffective. MDN's tutorial states the rule directly: something inside the loop must change the condition, and a loop whose condition never becomes false runs forever.<sup>[7](https://learn.microsoft.com/en-us/dotnet/csharp/fundamentals/statements/iteration)</sup> The C# tutorial gives the same warning for `while`: if the condition never changes to false, the program never ends.<sup>[8](https://learn.microsoft.com/en-us/dotnet/csharp/tour-of-csharp/tutorials/branches-and-loops)</sup> The Microsoft C# reference also shows the deliberate form, an empty-condition `for` loop, as "the infinite `for` loop".<sup>[9](https://learn.microsoft.com/dotnet/csharp/language-reference/statements/iteration-statements)</sup>

**Exit paths besides the condition.** Most languages provide jump statements that can end a loop regardless of its condition. In C#, `break` exits the nearest enclosing `switch`, `while`, `do`, `for`, or `foreach` statement, and `continue` skips to the next iteration; a `break` outside any such statement is a compile-time error.<sup>[10](https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-specification/statements)</sup> [JavaScript](https://www.edgepedia.org/javascript) behaves the same way: `break` goes to the first statement after the loop and `continue` re-evaluates the condition.<sup>[6](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/while)</sup> [Visual Basic](https://www.edgepedia.org/visual-basic) offers `Exit While` specifically for escaping a condition that "could cause an endless loop, which is a loop that could run an extremely large or even infinite number of times".<sup>[11](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/while-end-while-statement)</sup> A loop written as `while (true)` with a `break` guarded by an internal test is therefore a common, controlled idiom for an intentionally unbounded loop.

## Common causes

CWE-835's demonstrative examples illustrate two recurring patterns. The first is a retry loop with no bound: a C function that reconnects to a server in a `do/while (connected < 0)` loop spins forever if the server never responds, consuming system resources and enabling a denial-of-service attack; the corrected version adds a counter and tests `count < MAX_ATTEMPTS`.<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup> The second is an unvalidated input: a Java inventory method loops `while (inventoryCount > minimumCount)`, subtracting `rateSold` each pass; if `rateSold` is zero the count never falls, so the loop never ends, and the fix validates that `rateSold` is at least 1.<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup>

The observed CVE list attached to CWE-835 shows how varied the triggers are: an off-by-one error over invalid hex-encoded characters (CVE-2011-1027), a NULL UDP packet never cleared from a queue (CVE-2011-1002), improperly clearing a pointer in a linked list (CVE-2010-2534), and an integer overflow in an image-size calculation that loops while allocating buffers until the stack fills (CVE-2013-1591).<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup>

**Floating-point conditions.** The CERT rule FLP30-C forbids floating-point variables as loop counters because rounding makes termination tests unreliable. Two CVEs show the failure mode in practice: floating-point conversion routines that cycle back and forth between two different values (CVE-2010-4476 and CVE-2010-4645), and a 2006 browser crash attributed to looping logic that relied on floating-point math to exit.<sup>[5](https://wiki.sei.cmu.edu/confluence/spaces/flyingpdf/pdfpageexport.action?pageId=87152157)</sup><sup> • </sup><sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup>

## Consequences

The direct cost of an unintended infinite loop is resource consumption. CWE-835 lists denial of service through CPU consumption, memory consumption, and amplification, with the software slowing down or taking a long time to respond.<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup> Oracle's Java troubleshooting guide describes the operational symptom: a bug that sends one or more threads into an infinite loop can consume all available CPU cycles, and an apparent hang that leaves the process busy is likely a looping thread rather than a deadlock.<sup>[3](https://docs.oracle.com/en/java/javase/15/troubleshoot/troubleshoot-process-hangs-and-loops.html)</sup> Oracle's ATG installation guide gives the same diagnostic rule of thumb: if a Java process sits at 100 percent CPU utilization, the cause is either an out-of-memory problem or a CPU-burning thread, possibly an infinite loop.<sup>[12](https://docs.oracle.com/cd/E41069_01/Platform.11-0/ATGInstallGuide/ATGInstallGuide.pdf)</sup>

In browser JavaScript the blast radius is contained by the environment. MDN warns that a loop that never ends will either be forced to stop by the browser or crash the page.<sup>[2](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Scripting/Loops)</sup> On servers the same defect scales into a denial-of-service condition: OWASP's DoS material notes that when an attacker can force a resource-demanding loop body to execute a very high number of times, the server's ability to handle other requests degrades.<sup>[13](https://community.owasp.org/attacks/Denial_of_Service)</sup> The weakness also reaches new platforms: OWASP's GenAI incident-response guide lists a prompt injection leading to an infinite loop among the technical failures that can make an AI system consume vast resources, causing outages or denial-of-service conditions.<sup>[14](https://genai.owasp.org/download/49068/?tmstv=1753687643)</sup>

## Intentional infinite loops

Not every infinite loop is a defect. Programs that must run until shut down are structured as deliberate unbounded loops. Python's asyncio event loop offers `run_forever()`, which runs until `stop()` is called, at which point the loop finishes the current batch of callbacks and exits.<sup>[4](https://docs.python.org/3.10/library/asyncio-eventloop.html)</sup> Browser animation works the same way: a function that draws a frame and then calls `window.requestAnimationFrame()` on itself keeps the animation loop running indefinitely, and the loop ends only when the function stops re-calling it or `cancelAnimationFrame()` is invoked.<sup>[15](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Client-side_APIs/Drawing_graphics)</sup> The design requirement in these cases is not that the loop terminate, but that each iteration have a defined exit path, such as a stop request, a signal handler, or a cancellation call.

## Detection and prevention

**Runtime diagnosis.** For a Java process, Oracle's procedure is to determine first whether the process is idle or consuming all available CPU, then take a thread dump with Control+\ (Linux), Control+Break (Windows), or `kill -QUIT pid`; the stacks of threads in the RUNNABLE state show which thread is looping and where. If the console is unavailable, the `jstack` or `jhsdb jstack` utility serves the same purpose, and a thread that stays continuously RUNNABLE can indicate a HotSpot VM bug rather than an application defect.<sup>[3](https://docs.oracle.com/en/java/javase/15/troubleshoot/troubleshoot-process-hangs-and-loops.html)</sup>

**Runtime guards.** Interpreted and scripting environments can add their own watchdogs. The CSCS scripting language described in MSDN Magazine proactively checks for an infinite loop after a configured number of iterations: if the exact same values appear in the while condition over successive cycles, or a maximum cycle count is exceeded, it throws an exception reporting the loop.<sup>[16](https://learn.microsoft.com/en-us/archive/msdn-magazine/2016/february/csharp-customizable-scripting-in-csharp)</sup>

**Static analysis.** CWE-835 rates automated static analysis (SAST) as highly effective for finding some instances of the weakness: the tool builds a model of data and control flow and searches for patterns connecting input sources to loop conditions.<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup> Research has gone further toward repair: the Infinitel system, described in a 2015 arXiv paper, automatically repairs infinite loops, addressing a bug class the authors note every programmer and user has experienced.<sup>[17](https://arxiv.org/abs/1504.05078)</sup>

**Prevention by construction.** The practical countermeasures follow from the causes: ensure something in the body changes the tested condition, validate inputs that feed loop conditions, bound retry loops with attempt counters, and use integer rather than floating-point counters.<sup>[1](https://cwe.mitre.org/data/definitions/835.html)</sup><sup> • </sup><sup>[2](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Scripting/Loops)</sup><sup> • </sup><sup>[5](https://wiki.sei.cmu.edu/confluence/spaces/flyingpdf/pdfpageexport.action?pageId=87152157)</sup>

## References

1. [CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop'), MITRE](https://cwe.mitre.org/data/definitions/835.html)
2. [Looping code, MDN Learn Web Development](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/Scripting/Loops)
3. [Troubleshoot Process Hangs and Loops, Oracle Java SE 15](https://docs.oracle.com/en/java/javase/15/troubleshoot/troubleshoot-process-hangs-and-loops.html)
4. [Event Loop, Python 3.10 documentation](https://docs.python.org/3.10/library/asyncio-eventloop.html)
5. [FLP30-C. Do not use floating-point variables as loop counters, SEI CERT Coding Standard](https://wiki.sei.cmu.edu/confluence/spaces/flyingpdf/pdfpageexport.action?pageId=87152157)
6. [while, JavaScript Reference, MDN](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/while)
7. [Iteration statements in C#, Microsoft Learn](https://learn.microsoft.com/en-us/dotnet/csharp/fundamentals/statements/iteration)
8. [Branches and loops, A tour of C#, Microsoft Learn](https://learn.microsoft.com/en-us/dotnet/csharp/tour-of-csharp/tutorials/branches-and-loops)
9. [Iteration statements, C# language reference, Microsoft Learn](https://learn.microsoft.com/dotnet/csharp/language-reference/statements/iteration-statements)
10. [Statements, C# language specification, Microsoft Learn](https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/language-specification/statements)
11. [While...End While Statement, Visual Basic, Microsoft Learn](https://learn.microsoft.com/en-us/dotnet/visual-basic/language-reference/statements/while-end-while-statement)
12. [ATG Installation Guide 11.0, Oracle](https://docs.oracle.com/cd/E41069_01/Platform.11-0/ATGInstallGuide/ATGInstallGuide.pdf)
13. [Denial of Service, OWASP Foundation](https://community.owasp.org/attacks/Denial_of_Service)
14. [GenAI Incident Response Guide, OWASP GenAI](https://genai.owasp.org/download/49068/?tmstv=1753687643)
15. [Drawing graphics, MDN Learn Web Development](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Client-side_APIs/Drawing_graphics)
16. [Customizable Scripting in C#, MSDN Magazine (2016)](https://learn.microsoft.com/en-us/archive/msdn-magazine/2016/february/csharp-customizable-scripting-in-csharp)
17. [Automatic Repair of Infinite Loops, arXiv:1504.05078](https://arxiv.org/abs/1504.05078)

---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Software and programming*

*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*

*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*

License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license