Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-41292MEDIUMLong list of incoming EDNS options degrades performanceEPSS 0.7%CVE-2026-71321HIGHNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationEPSS 0.7%CVE-2026-66046HIGHExpat Denial of Service via storeAtts() Quadratic ComplexityEPSS 0.7%CVE-2026-75005HIGHApache APISIX: Unauthenticated CPU-exhaustion DoSEPSS 0.7%CVE-2025-11230HIGHDenial of service vulnerability in HAProxy mjson libraryEPSS 0.7%CVE-2026-59870HIGHjs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsingEPSS 0.7%CVE-2026-82760HIGHSuperlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inEPSS 0.7%CVE-2024-9631HIGHInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2026-49329HIGHOpenshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpointsEPSS 0.7%CVE-2024-6324MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.7%CVE-2026-55685HIGHReact Router: Unauthenticated Denial of Service via Inefficient Route MatchingEPSS 0.7%CVE-2026-90776HIGHNodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address ParsingEPSS 0.7%CVE-2026-63446HIGHSuricata app-layer: passed flows can retain transactions, causing resource exhaustionEPSS 0.7%CVE-2025-24947MEDIUMA hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attaEPSS 0.7%CVE-2026-87822HIGHt-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytesEPSS 0.7%CVE-2026-64644MEDIUMNext.js: Denial of Service in the Image Optimization API using SVGsEPSS 0.7%CVE-2026-59880HIGHImmutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetEPSS 0.7%CVE-2025-14831MEDIUMGnutls: gnutls: denial of service via excessive resource consumption during certificate verificationEPSS 0.7%CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2026-112401MEDIUMPillow: Quadratic GIF comment concatenation allows DoS in Image.open()EPSS 0.6%