Weaknesses of type CWE-407

174 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2023-26485MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2023-22484LOWInefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of serviceEPSS 1.0%CVE-2026-54892HIGHPlug: quadratic-time decoding of nested query/body parameters enables denial of serviceEPSS 0.9%CVE-2022-22153HIGHSRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsEPSS 0.9%CVE-2023-2473MEDIUMDreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexityEPSS 0.9%CVE-2024-23684HIGHupokecenter CBOR Denial of ServiceEPSS 0.9%CVE-2026-33033MEDIUMPotential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploadEPSS 0.9%CVE-2020-3548MEDIUMCisco Email Security Appliance Denial Of Service VulnerabilityEPSS 0.8%CVE-2025-12084MEDIUMQuadratic complexity in node ID cache clearingEPSS 0.8%CVE-2026-75005HIGHApache APISIX: Unauthenticated CPU-exhaustion DoSEPSS 0.8%CVE-2026-59094HIGHPathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document StoreEPSS 0.8%CVE-2024-8233HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.8%CVE-2024-9631HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2024-6324MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2025-11230HIGHDenial of service vulnerability in HAProxy mjson libraryEPSS 0.7%CVE-2025-24947MEDIUMA hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attaEPSS 0.7%CVE-2026-64644MEDIUMNext.js: Denial of Service in the Image Optimization API using SVGsEPSS 0.7%CVE-2026-69184HIGHc-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chainsEPSS 0.7%CVE-2025-14831MEDIUMGnutls: gnutls: denial of service via excessive resource consumption during certificate verificationEPSS 0.7%