Weaknesses of type CWE-407

173 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2026-59868MEDIUMjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.6%CVE-2026-59870MEDIUMjs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2026-34573HIGHParse Server: GraphQL complexity validator exponential fragment traversal DoSEPSS 0.6%CVE-2025-62727HIGHStarlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseEPSS 0.6%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.6%CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.6%CVE-2026-44390MEDIUMUnbounded name compression in certain cases causes degradation of serviceEPSS 0.6%CVE-2026-43967HIGHQuadratic fragment-name uniqueness check causes denial of service in absintheEPSS 0.6%CVE-2026-66046HIGHExpat Denial of Service via storeAtts() Quadratic ComplexityEPSS 0.6%CVE-2024-8237MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 0.6%CVE-2024-11828MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2026-57480HIGHParse Server: Denial of service via exponential-time processing of deeply nested query operatorsEPSS 0.6%CVE-2026-40476MEDIUMgraphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validationEPSS 0.6%CVE-2025-23020MEDIUMAn issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote aEPSS 0.6%