CWE-835 is a weakness class for code that can enter an infinite loop or otherwise keep running without a valid exit condition. In practice, the software keeps consuming CPU time and may stop progressing, even though it has not crashed.
This matters in cyber security because an attacker or malformed input can sometimes trigger the bad logic path and create a denial-of-service condition. In industrial controllers, parsers, protocol handlers, and safety logic are especially sensitive: a stuck loop can delay control decisions, trip a fault state, or force manual recovery. Defenders look for bounded loops, clear termination checks, input validation, timeout handling, and watchdogs that can break out of runaway logic. Mapping a bug to CWE-835 helps teams understand that the primary risk is availability, not code execution or data theft, and it guides testing toward malformed inputs, edge cases, and recovery behavior.