Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-44390MEDIUMUnbounded name compression in certain cases causes degradation of serviceEPSS 0.6%CVE-2026-67216HIGHcJSON cJSON_Compare Exponential Complexity Denial of ServiceEPSS 0.6%CVE-2026-59868MEDIUMjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.6%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-34573HIGHParse Server: GraphQL complexity validator exponential fragment traversal DoSEPSS 0.6%CVE-2026-40476MEDIUMgraphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validationEPSS 0.6%CVE-2026-92987HIGHroxmltree through 0.21.1 Denial of Service via Quadratic ParsingEPSS 0.6%CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.6%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.6%CVE-2026-63447HIGHSuricata ftp: crafted FTP traffic can cause quadratic CPU consumptionEPSS 0.6%CVE-2023-36810MEDIUMQuadratic runtime with malformed PDF missing xref marker in pypdfEPSS 0.6%CVE-2026-55099HIGHicalendar: Algorithmic Complexity in EqualityEPSS 0.6%CVE-2026-119741HIGHrsync < 3.5.2 Denial of Service via hash_search() Checksum CollisionsEPSS 0.6%CVE-2026-43967HIGHQuadratic fragment-name uniqueness check causes denial of service in absintheEPSS 0.6%CVE-2026-71418HIGHSuricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumptionEPSS 0.6%CVE-2026-121437HIGHMistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimitersEPSS 0.6%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.6%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.6%