CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Also known as Quadratic Complexity.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- fastapiexpert python-multipartPython-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service7.5 High
- nodemailerNodemailer before 9.1.0 Denial of Service via addressparser8.7 High
- nodeca js-yamljs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases5.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Algorithmic Denial of Service via SpEL Expressions7.5 High
- bytedance infinistorebytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity4.8 Medium
- securly, securly chrome extension +1 moreCVE-2026-88897.5 High
- python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morePotential DoS via quadratic complexity in unicodedata.normalize()6.3 Medium
- go standard library mimeQuadratic complexity in WordDecoder.DecodeHeader in mime7.5 High
- nezumi text::linefoldText::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters6.2 Medium
- botan project botanBotan: Quadratic complexity decoding BER indefinite length encodings6.9 Medium
- pmqs io::uncompress::unzip, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward7.5 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreUnbounded name compression in certain cases causes degradation of service6.9 Medium
- nlnet labs unboundDegradation of service with unbounded NSEC3 hash calculations6.9 Medium
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performance6.6 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Policy Bypass in MNG coder could5.3 Medium
- libexpat project libexpat, red hat discovery 2, enterprise linux 10 +11 more +13 moreIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows...2.9 Low
- emilstenstrom justhtmljusthtml before 1.18.0 Denial of Service via CSS Selector8.7 High
- absinthe-graphql absintheQuadratic fragment-name uniqueness check causes denial of service in absinthe8.7 High
- twistedTwisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains7.5 High
- ruby net-imap, ruby-lang net\ +1 morenet-imap: Quadratic complexity when reading response literals2.3 Low
- hickory-dnsHickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression8.7 High
- nodeca js-yamljs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing7.5 High
- nodeca js-yamljs-yaml: YAML merge-key chains can force quadratic CPU consumption5.3 Medium
- No product listedNordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.7.5 High
- webonyx graphql-phpgraphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation6.9 Medium
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 morejq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed7.5 High
- go-vikunja vikunjaVikunja has an Algorithmic Complexity DoS in Repeating Task Handler6.5 Medium
- musl libcmusl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity4.8 Medium
@chenglou/pretextnpmPretext: Algorithmic Complexity (DoS) in the text analysis phase8.7 High- djangoproject djangoPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload6.5 Medium
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Algorithmic-Complexity DoS in Rack::Multipart::Parser7.5 High
- rackRack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header5.3 Medium
- parse-community parse-serverParse Server: GraphQL complexity validator exponential fragment traversal DoS8.2 High
- oisf suricataSuricata dcerpc: quadratic complexity in dcerpc buffering7.5 High
- oisf suricataSuricata smtp/mine: quadratic complexity in extracting urls7.5 High
- oisf suricataSuricata stream: quadratic complexity in stream inspection7.5 High
- oisf suricataSuricata krb5: quadratic complexity in krb5 buffering7.5 High
- gitlabInefficient Algorithmic Complexity in GitLab7.5 High
- py-pdf pypdfpypdf has inefficient decoding of array-based streams5.1 Medium
- py-pdf pypdfpypdf: Inefficient decoding of ASCIIHexDecode streams6.9 Medium
- isaacs minimatchminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments7.5 High
- red hat cert manager support for red hat openshift release 1.18, ai inference server 3.2, ai inference server 3.3 +23 more +25 moreGnutls: gnutls: denial of service via excessive resource consumption during certificate verification5.3 Medium
- djangoproject djangoPotential denial-of-service vulnerability in django.utils.text.Truncator HTML methods7.5 High
- djangoproject django, asgiref +1 morePotential denial-of-service vulnerability via repeated headers when using ASGI7.5 High
- mattermost, mattermost server +1 moreDoS from quadratic complexity in model.ParseHashtags3.1 Low
github.com/open-feature/flagd/coreGo,github.com/open-feature/flagd/flagdGo,github.com/open-feature/flagd/flagd-proxyGo +2 moreflagd: Multiple Go Runtime CVEs Impact Security and AvailabilityNo score- python, python software foundation cpython +1 moreQuadratic complexity in node ID cache clearing6.3 Medium
- djangoproject djangoPotential denial-of-service vulnerability in XML serializer text extraction7.5 High
- libexpat project libexpat, siemens ruggedcom rst2428p, simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of...2.9 Low
- djangoproject djangoPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows7.5 High
- Show moreLoading…