Weaknesses of type CWE-407

273 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2024-21909HIGHDenial of service in CBOR libraryEPSS 1.1%CVE-2023-24824MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.0%CVE-2023-26485MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2026-84008HIGH.NET Denial of Service VulnerabilityEPSS 1.0%CVE-2023-22484LOWInefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of serviceEPSS 1.0%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2023-2473MEDIUMDreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexityEPSS 0.9%CVE-2024-23684HIGHupokecenter CBOR Denial of ServiceEPSS 0.9%CVE-2026-33033MEDIUMPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadEPSS 0.9%CVE-2026-70196MEDIUMASP.NET Core Denial of Service VulnerabilityEPSS 0.9%CVE-2026-54892HIGHPlug: quadratic-time decoding of nested query/body parameters enables denial of serviceEPSS 0.9%CVE-2025-12084MEDIUMQuadratic complexity in node ID cache clearingEPSS 0.9%CVE-2020-3548MEDIUMCisco Email Security Appliance Denial Of Service VulnerabilityEPSS 0.8%CVE-2026-68750HIGHQuadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of serviceEPSS 0.8%CVE-2025-62727HIGHStarlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseEPSS 0.8%CVE-2026-59094HIGHPathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document StoreEPSS 0.8%CVE-2026-85446HIGHMOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of ServiceEPSS 0.8%CVE-2024-8233HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.8%CVE-2026-61814HIGHJawn: Quadratic parsing effort in AsyncParserEPSS 0.8%