Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-42504HIGHQuadratic complexity in WordDecoder.DecodeHeader in mimeEPSS 0.6%CVE-2024-39702MEDIUMIn lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash DenEPSS 0.6%CVE-2026-48959HIGHIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForwardEPSS 0.6%CVE-2026-111758HIGHmarkdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)EPSS 0.5%CVE-2026-56860MEDIUMAvoid quadratic complexity in resolvePath in net/urlEPSS 0.5%CVE-2026-112891MEDIUMPillow: Quadratic GIF comment copying during saveEPSS 0.5%CVE-2025-24946MEDIUMThe hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a consideEPSS 0.5%CVE-2026-84375HIGHjs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesEPSS 0.5%CVE-2026-119195HIGHpyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingEPSS 0.5%CVE-2026-70453HIGHrsync < 3.5.0 Algorithmic Complexity DoS via hash_search()EPSS 0.5%CVE-2026-82398MEDIUMpypdf: Inefficient handling of non-whitespace inputs in read_until_whitespaceEPSS 0.5%CVE-2026-82729MEDIUMQuadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoSEPSS 0.5%CVE-2026-92365MEDIUMvllm-project vllm thinking_budget_state.py algorithmic complexityEPSS 0.5%CVE-2026-81722HIGHnltk PorterStemmer before 3.10.3 Quadratic-time DoSEPSS 0.5%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.5%CVE-2026-16762HIGHDenial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts QtEPSS 0.5%CVE-2026-86429HIGHcommonmark before 2.9.1 Denial of Service via SmartPunct and AttributesEPSS 0.5%CVE-2026-49250HIGHConform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsEPSS 0.5%CVE-2026-86434HIGHcommonmark 2.0.0 through 2.8.3 Denial of Service via Slug CollisionEPSS 0.5%CVE-2026-86433HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via AttributesEPSS 0.5%