CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Also known as Quadratic Complexity.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- py-pdf pypdfpypdf: Possible long runtimes/large memory usage when parsing indirect objects8.7 High
- opensslPotential CPU DoS via O(n^2) Fragment Reassembly in QUIC5.3 Medium
- juliangruber brace-expansionbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service5.3 Medium
- nodemailernodemailer before 10.0.6 Denial of Service via addressparser8.7 High
- gerritDenial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review8.7 High
- typelevel jawn, org.typelevel jawn-parser 2.12, jawn-parser 2.13 +1 more +3 moreJawn: Quadratic parsing effort in AsyncParser7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Consecutive topic wildcards cause combinatorial routing work7.1 High
- erlang otpSuperlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder8.2 High
libnet-idn-encode-perlDebian,perl-Net-IDN-EncodeopenSUSE +1 moreNet::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii7.5 Highlibnet-idn-encode-perlDebian,perl-Net-IDN-EncodeopenSUSE +1 moreNet::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode7.5 High- oisf suricataSuricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption7.5 High
- oisf suricataSuricata app-layer: passed flows can retain transactions, causing resource exhaustion7.5 High
- oisf suricataSuricata ftp: crafted FTP traffic can cause quadratic CPU consumption7.5 High
- oisf suricataSuricata smb: some SMB flows can cause resource exhaustion5.9 Medium
- sveltejs devaluedevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5 High
- nanomqNanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing3.7 Low
- razrfalcon roxmltreeroxmltree through 0.21.1 Denial of Service via Quadratic Parsing8.7 High
- team-alembic ash authenticationSuperlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in8.2 High
- isc bind 9Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching5.3 Medium
- vllm-project vllmvllm-project vllm thinking_budget_state.py algorithmic complexity5.3 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +5 more +7 moreJwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array5.9 Medium
- mattermost, mattermost server +1 moreMattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting4.3 Medium
- mattermost, mattermost server +1 moreMattermost Markdown autolink parsing denial of service4.3 Medium
- nodemailerNodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing8.7 High
- tdunning t-digestt-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes8.7 High
- thephpleague commonmarkcommonmark 1.5.0 before 2.8.4 Denial of Service via Footnote8.7 High
- thephpleague commonmarkcommonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision8.7 High
- thephpleague commonmarkcommonmark 1.5.0 before 2.8.4 Denial of Service via Attributes8.7 High
- thephpleague commonmarkleague/commonmark before 2.9.1 Denial of Service via parsing8.7 High
- thephpleague commonmarkcommonmark before 2.9.1 Denial of Service via SmartPunct and Attributes8.7 High
- thephpleague commonmarkcommonmark 1.5.0 before 2.10.0 Denial of Service via Attributes8.7 High
- elixir-mint mintQuadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS6.3 Medium
- mit moos-ivpMOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service8.7 High
- uhop stream-jsonstream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)6.2 Medium
- pydantic httpx2HTTPX2: Quadratic SSE line buffering can cause CPU denial of service5.9 Medium
- andialbrecht sqlparsesqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption5.1 Medium
- red hat openshift container platform 4.13, openshift container platform 4.14, openshift container platform 4.15 +8 more +10 moreOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints7.5 High
- @xmldom xmldomxmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge8.7 High
- @xmldom xmldomxmldom: Quadratic-time attribute deduplication8.7 High
- py-pdf pypdfpypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace6.9 Medium
- ash-project ash paper trailAlgorithmic-complexity denial of service in AshPaperTrail full-diff list tracking2.1 Low
- nltkNLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView6.3 Medium
- nltknltk PorterStemmer before 3.10.3 Quadratic-time DoS8.7 High
- apache apisixApache APISIX: Unauthenticated CPU-exhaustion DoS8.7 High
- red hat enterprise linux 10Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix5.3 Medium
- collective icalendaricalendar: Algorithmic Complexity in Equality7.5 High
- splunk connect for kafkaRegular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka5.9 Medium
- nettyNetty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing8.7 High
- libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreExpat Denial of Service via storeAtts() Quadratic Complexity8.7 High
- andialbrecht sqlparsesqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger8.7 High
- Show moreLoading…