Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-13149HIGHbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number oEPSS 0.4%CVE-2026-31937HIGHSuricata dcerpc: quadratic complexity in dcerpc bufferingEPSS 0.4%CVE-2026-33123MEDIUMpypdf has inefficient decoding of array-based streamsEPSS 0.4%CVE-2026-13311HIGHshell-quote parse() is quadratic in token count, enabling denial of serviceEPSS 0.4%CVE-2026-6879LOWQuadratic Behavior in xml.etree.ElementPath Index PredicatesEPSS 0.4%CVE-2026-117540HIGHsvg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping LoopEPSS 0.4%CVE-2026-76271MEDIUMDenial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk EnterpriseEPSS 0.4%CVE-2025-14822LOWDoS from quadratic complexity in model.ParseHashtagsEPSS 0.3%CVE-2026-102999HIGHpypdf: Possible long runtimes with large amount of embedded filesEPSS 0.3%CVE-2026-35599MEDIUMVikunja has an Algorithmic Complexity DoS in Repeating Task HandlerEPSS 0.3%CVE-2026-107579HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-77680MEDIUMLibsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixEPSS 0.3%CVE-2026-94658HIGHApache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)EPSS 0.3%CVE-2026-94655HIGHApache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadraticEPSS 0.3%CVE-2026-96287HIGHApache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)EPSS 0.3%CVE-2026-102994HIGHpypdf: Possible long runtimes/large memory usage when parsing indirect objectsEPSS 0.3%CVE-2026-102997HIGHpypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)EPSS 0.3%CVE-2026-42923MEDIUMDegradation of service with unbounded NSEC3 hash calculationsEPSS 0.3%CVE-2026-100700HIGHnodemailer before 10.0.6 Denial of Service via addressparserEPSS 0.3%CVE-2026-54284HIGHsqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerEPSS 0.3%