CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Also known as Quadratic Complexity.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression 8.7 High
- zcashfoundation zebra Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation 8.7 High
- zcashfoundation zebra Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check 8.7 High
- sensiolabs symfony Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process 8.7 High
- kyverno Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching 8.3 High
- fasterxml jackson-dataformat-cbor jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC) No score
- rsyncproject rsync rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions 8.7 High
- lepture mistune Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters 8.7 High
-
github.com/anacrolix/torrentGo anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS 6.5 Medium - No product listed DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds 7.5 High
- pyasn1 pyasn1: Quadratic-complexity denial of service in binary REAL decoding 7.5 High
- pyasn1 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding 7.5 High
- pyasn1 pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding 7.5 High
- pyasn1 pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding 7.5 High
- daptin Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware 8.7 High
- gomarkdown markdown Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing 8.7 High
- python-markdown2 python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations 8.7 High
- samverschueren decode-uri-component decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs 8.2 High
-
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 more MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords 7.5 High -
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 more MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message 7.5 High -
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary 7.5 High - le0pard re2js RE2JS: Quadratic-time denial of service in re2js lookbehind matching 7.5 High
- progress software telerik document processing libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering 7.5 High
- progress software telerik document processing libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing 7.5 High
- golang.org/x/net golang.org/x/net/html Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net 7.5 High
- darylldoyle svg-sanitizer svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop 8.7 High
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 more Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters 8.7 High
- go-jose Go JOSE: DoS when parsing JWKs that contain RSA keys 7.5 High
- tornadoweb tornado Tornado: Quadratic CPU usage when parsing HTTP headers with line folding 5.3 Medium
- appsup-dart jose erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service 6.9 Medium
- mtrudel bandit SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit 8.7 High
- mtrudel bandit Quadratic bignum parsing of Content-Length and Host port values in Bandit 8.7 High
-
postal-mimenpm postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words 7.5 High - py-pdf pypdf pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) 7.1 High
- qt Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt 8.7 High
- eclipse foundation keypont - gose Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s 6.9 Medium
- lepture mistune Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser 8.7 High
- lepture mistune Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text 8.7 High
- graphql-python graphql-core GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule 7.5 High
- fzf fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents 2.0 Low
- python pillow Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time 7.1 High
- binarymuse toml-node toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() 8.7 High
- binarymuse toml-node toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() 8.7 High
- encode django-rest-framework Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation 7.5 High
- uhop stream-json stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service 6.2 Medium
- py-pdf pypdf pypdf: Possible long runtimes/large memory usage when retrieving form fields 6.0 Medium
- isc bind 9 Amplified resource exhaustion in inbound message processing 7.5 High
- python pillow Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion 8.2 High
- moov-io signedxml Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization 7.5 High
- markdown-it markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) 7.5 High
- Show olderLoading…