Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-31934HIGHSuricata smtp/mine: quadratic complexity in extracting urlsEPSS 0.3%CVE-2026-65634HIGHSuperlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoderEPSS 0.3%CVE-2026-55206HIGHpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()EPSS 0.3%CVE-2026-71491HIGHsqlparse: Quadratic O(n²) DoS in group_commentsEPSS 0.3%CVE-2026-107583MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-107582MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-107580MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.3%CVE-2026-114129MEDIUMstream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceEPSS 0.3%CVE-2025-55304LOWExiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadataEPSS 0.3%CVE-2026-107581MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.2%CVE-2026-6042MEDIUMmusl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexityEPSS 0.2%CVE-2026-65631MEDIUMerlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of serviceEPSS 0.2%CVE-2026-95838MEDIUMcontainerd: Unpack DoS via repeated opaque whiteoutsEPSS 0.2%CVE-2025-66382LOWIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.EPSS 0.2%CVE-2026-104182MEDIUMstream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunkEPSS 0.2%CVE-2026-8594MEDIUMText::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break charactersEPSS 0.2%CVE-2026-87768HIGHDateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding secondsEPSS 0.2%CVE-2026-84305MEDIUMsqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumptionEPSS 0.2%CVE-2026-77831LOWAlgorithmic-complexity denial of service in AshPaperTrail full-diff list trackingEPSS 0.2%CVE-2026-106554—jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)EPSS 0.2%