Weaknesses of type CWE-407

173 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-75596HIGHNetty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingEPSS 0.4%CVE-2026-31933HIGHSuricata stream: quadratic complexity in stream inspectionEPSS 0.4%CVE-2026-71418HIGHSuricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumptionEPSS 0.4%CVE-2026-85446HIGHMOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of ServiceEPSS 0.4%CVE-2026-33123MEDIUMpypdf has inefficient decoding of array-based streamsEPSS 0.3%CVE-2026-35599MEDIUMVikunja has an Algorithmic Complexity DoS in Repeating Task HandlerEPSS 0.3%CVE-2026-71488HIGHleague/commonmark: Quadratic-time denial of service when parsing crafted MarkdownEPSS 0.3%CVE-2026-83613HIGHxmldom: Quadratic-time attribute deduplicationEPSS 0.3%CVE-2026-73643HIGHjs-yaml: Exponential parsing time in the flow collections leads to denial of serviceEPSS 0.3%CVE-2026-77680MEDIUMLibsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixEPSS 0.3%CVE-2026-42923MEDIUMDegradation of service with unbounded NSEC3 hash calculationsEPSS 0.3%CVE-2026-44639LOWNanoMQ: O(N²) Denial of Service in MQTT v5 Property ParsingEPSS 0.3%CVE-2026-73413HIGHShescape: Quadratic-time denial of service in flag-protectionEPSS 0.3%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.3%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.3%CVE-2023-54395MEDIUMPocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacketEPSS 0.3%CVE-2026-44378MEDIUMBotan: Quadratic complexity decoding BER indefinite length encodingsEPSS 0.3%CVE-2026-55206HIGHpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()EPSS 0.3%CVE-2026-84378MEDIUMHTTPX2: Quadratic SSE line buffering can cause CPU denial of serviceEPSS 0.3%CVE-2024-29916MEDIUMThe dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged kEPSS 0.3%