CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Also known as Quadratic Complexity.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- qtDenial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt8.7 High
- python pillowPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)8.7 High
- python pillowPillow: Quadratic GIF comment copying during save6.9 Medium
- python pillowPillow: Quadratic GIF comment concatenation allows DoS in Image.open()6.9 Medium
- markdown-itmarkdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled3.7 Low
libcpanel-json-xs-perlDebian,perl-Cpanel-JSON-XSMageia +1 moreCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse7.5 High- markdown-itmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes7.5 High
libtext-csv-xs-perlDebian,perl-Text-CSV_XSAzure Linux +1 moreText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline7.5 High- dicklesworthstone destructive command guarddcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open7.1 High
- j4care dcm4chee-arc-lightJ4Care dcm4che Inefficient Algorithmic Complexity8.7 High
- eclipse vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],...8.7 High
- nodemailerNodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing8.2 High
- nodemailerNodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service7.1 High
- ow2 asmOW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter6.8 Medium
- ow2 asmOW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES6.8 Medium
- ow2 asmOW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers6.8 Medium
- microsoft .net, .net framework, .net framework 3.5 +8 more +10 more.NET Denial of Service Vulnerability7.5 High
- microsoft .net framework 3.5, .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2, .net framework 3.5 and 4.7.2 +8 more +10 more.NET Denial of Service Vulnerability7.5 High
- microsoft asp.net core 10.0, asp.net core 8.0, asp.net core 9.0 +2 more +4 moreASP.NET Core Denial of Service Vulnerability5.9 Medium
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +11 more +13 more.NET Denial of Service Vulnerability7.5 High
- containerdcontainerd: Unpack DoS via repeated opaque whiteouts4.6 Medium
- gitoxidelabs gix-mailmapGitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing5.3 Medium
- kozea cairosvgCairoSVG: Quadratic-time DoS parsing a crafted SVG <path>8.7 High
- mcollina msgpack5msgpack5: Quadratic parsing in the streaming decoder5.9 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`6.5 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: Excessive resource use when local web fetching converts nested HTML6.5 Medium
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer6.5 Medium
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer6.5 Medium
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer6.5 Medium
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer6.5 Medium
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer7.5 High
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer7.5 High
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer5.3 Medium
- progressive robot ltd hmailserverInefficient Algorithmic Complexity in hMailServer7.5 High
- splunk, splunk enterprise +1 moreDenial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk Enterprise6.5 Medium
- giteaGitea issue reference parsing CPU exhaustion6.5 Medium
- djangoproject djangoPotential denial-of-service vulnerability in HTTP header parsing6.9 Medium
smol-tomlnpmsmol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line5.3 Medium- postcss postcss-selector-parserPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion5.9 Medium
- apache software foundation thriftApache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)8.2 High
- apache software foundation thriftApache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)8.7 High
- apache software foundation thriftApache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic8.2 High
- apache software foundation thriftApache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)8.2 High
- zcashfoundation zebraZebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check8.2 High
- apache software foundation thriftApache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)8.2 High
- apache software foundation thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pee…8.7 High
- bouncycastle bc-csharpQuadratic-time escaping when converting X.509 distinguished names to strings8.7 High
- uhop stream-jsonstream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk6.2 Medium
- py-pdf pypdfpypdf: Possible long runtimes with large amount of embedded files8.7 High
- py-pdf pypdfpypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)8.7 High
- Show moreLoading…