Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2024-11828MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2024-8237MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%CVE-2026-83613HIGHxmldom: Quadratic-time attribute deduplicationEPSS 0.6%CVE-2026-96640HIGHPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionEPSS 0.6%CVE-2026-108529HIGHSETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in BanditEPSS 0.6%CVE-2026-113436HIGHQuadratic bignum parsing of Content-Length and Host port values in BanditEPSS 0.6%CVE-2026-75507HIGHGraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleEPSS 0.6%CVE-2026-114138HIGHDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationEPSS 0.6%CVE-2026-112894HIGHPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)EPSS 0.6%CVE-2026-111759HIGHmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotesEPSS 0.6%CVE-2026-73413HIGHShescape: Quadratic-time denial of service in flag-protectionEPSS 0.6%CVE-2025-29908MEDIUMNetty QUIC hash collision DoS attackEPSS 0.6%CVE-2026-57480HIGHParse Server: Denial of service via exponential-time processing of deeply nested query operatorsEPSS 0.6%CVE-2026-83614HIGHxmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergeEPSS 0.6%CVE-2026-59869HIGHjs-yaml: YAML merge-key chains can force quadratic CPU consumptionEPSS 0.6%CVE-2025-23020MEDIUMAn issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote aEPSS 0.6%CVE-2026-27903HIGHminimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsEPSS 0.6%CVE-2026-58226HIGHUnauthenticated denial-of-service via unbounded HPACK integer decoding in hpaxEPSS 0.6%CVE-2026-92091MEDIUMJwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayEPSS 0.6%CVE-2024-8177MEDIUMInefficient Algorithmic Complexity in GitLabEPSS 0.6%