Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-89314MEDIUMQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEPSS 0.4%CVE-2026-116577MEDIUMTornado: Quadratic CPU usage when parsing HTTP headers with line foldingEPSS 0.4%CVE-2026-107378HIGHCairoSVG: Quadratic-time DoS parsing a crafted SVG <path>EPSS 0.4%CVE-2026-76401MEDIUMRegular Expression Denial of Service (DoS) through the REST API in Splunk Connect for KafkaEPSS 0.4%CVE-2026-87081HIGHNet::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_asciiEPSS 0.4%CVE-2026-87079HIGHNet::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycodeEPSS 0.4%CVE-2026-53433MEDIUMDenial of Service in fzfEPSS 0.4%CVE-2026-101021HIGHJ4Care dcm4che Inefficient Algorithmic ComplexityEPSS 0.4%CVE-2026-118036HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question AnsweringEPSS 0.4%CVE-2026-75596HIGHNetty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-67419HIGHRabbitMQ: Consecutive topic wildcards cause combinatorial routing workEPSS 0.4%CVE-2026-96643HIGHPillow: PNG eXIf chunk makes EXIF parsing run in quadratic timeEPSS 0.4%CVE-2025-30348MEDIUMencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with reEPSS 0.4%CVE-2026-72685MEDIUMInefficient Algorithmic Complexity in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-86349MEDIUMMattermost Server Algorithmic DoS via Unbounded Markdown Block NestingEPSS 0.4%CVE-2026-12882MEDIUMMattermost Markdown autolink parsing denial of serviceEPSS 0.4%CVE-2026-116587HIGHGo JOSE: DoS when parsing JWKs that contain RSA keysEPSS 0.4%CVE-2026-40164HIGHjq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedEPSS 0.4%CVE-2026-31933HIGHSuricata stream: quadratic complexity in stream inspectionEPSS 0.4%