CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Also known as Quadratic Complexity.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- andialbrecht sqlparsesqlparse: Quadratic O(n²) DoS in group_comments8.7 High
- c-aresc-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains7.5 High
nltkDebianNLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars6.9 Medium- go standard library net/urlAvoid quadratic complexity in resolvePath in net/url5.9 Medium
- elastic kibanaInefficient Algorithmic Complexity in Kibana Leading to Denial of Service6.5 Medium
- elastic elasticsearchInefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service4.3 Medium
- rsyncproject rsyncrsync < 3.5.0 Algorithmic Complexity DoS via hash_search()8.7 High
- honojs honoHono: Algorithmic Complexity DoS in Language Middleware5.3 Medium
- thephpleague commonmarkLeague CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass5.3 Medium
- thephpleague commonmarkleague/commonmark: Quadratic-time denial of service when parsing crafted Markdown7.5 High
- thephpleague commonmarkleague/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes6.1 Medium
- rrrene htmlsanitizeex, html sanitize ex +1 moreQuadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service8.2 High
- @clerk nuxtNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation7.5 High
- nodeca js-yamljs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources7.5 High
- bouncycastle bouncy castle for java lts, legion of the bouncy castle inc. bc-fja, bouncycastle bc-java +2 more +4 moreQuadratic-time escaping when stringifying X.500 distinguished names8.7 High
- cjson project cjsoncJSON cJSON_Compare Exponential Complexity Denial of Service8.2 High
- python software foundation cpythonQuadratic Behavior in xml.etree.ElementPath Index Predicates2.0 Low
- apache thriftApache Thrift: Node.js quadratic-time DoS in server receive transports8.7 High
- ericcornelissen shescapeShescape: Quadratic-time denial of service in flag-protection8.7 High
- nodeca js-yamljs-yaml: Exponential parsing time in the flow collections leads to denial of service7.5 High
- mtrudel banditQuadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit8.7 High
- @tanstack react-routerReact Router: Unauthenticated Denial of Service via Inefficient Route Matching8.7 High
- vercel next.jsNext.js: Denial of Service in the Image Optimization API using SVGs6.3 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service7.1 High
- gitea open source git serverParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests7.5 High
- pyasn1pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service7.5 High
- elysiajs elysiaElysia: Inefficient Algorithmic Complexity and Interpretation Conflict7.5 High
- lepture mistuneMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions7.5 High
- lepture mistuneinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs7.5 High
- lepture mistuneMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)7.5 High
- markdown-it linkify-itlinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text7.5 High
- immutable-js immutable, immutable-js +1 moreImmutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set8.7 High
- nodeca js-yamljs-yaml: YAML merge-key chains can force quadratic CPU consumption7.5 High
- elixir-mint hpaxUnauthenticated denial-of-service via unbounded HPACK integer decoding in hpax8.7 High
- extend themes pathwayPathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store8.7 High
- edmundhung conformConform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields8.7 High
- fzfDenial of Service in fzf5.7 Medium
- juliangruber brace-expansionbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups7.7 High
- samverschueren decode-uri-componentdecode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input6.6 Medium
- ljharb shell-quoteshell-quote parse() is quadratic in token count, enabling denial of service8.7 High
- lepture mistune, red hat migration toolkit for applications 8, openshift ai (rhoai) +3 more +5 moreMistune: Potential DoS via quadratic-time parsing in parse_link_text8.7 High
- elixir-plug plugPlug: quadratic-time decoding of nested query/body parameters enables denial of service8.7 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows8.2 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps6.3 Medium
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings6.3 Medium
- miurahr py7zrpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()8.7 High
- sunnyadn js-tomlCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals7.5 High
- parse-community parse-serverParse Server: Denial of service via exponential-time processing of deeply nested query operators8.7 High
- py-pdf pypdfpypdf: Inefficient decoding of FlateDecode PNG predictor streams5.1 Medium
- markdown-itmarkdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations5.3 Medium
- Show moreLoading…