Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-114143HIGHtoml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()EPSS 0.5%CVE-2026-72663MEDIUMInefficient Algorithmic Complexity in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2026-59887HIGHlinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textEPSS 0.5%CVE-2026-116795HIGHRE2JS: Quadratic-time denial of service in re2js lookbehind matchingEPSS 0.5%CVE-2026-53539HIGHPython-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of serviceEPSS 0.5%CVE-2026-113729HIGHMoov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationEPSS 0.5%CVE-2026-118694HIGHpython-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link DestinationsEPSS 0.5%CVE-2023-54395MEDIUMPocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacketEPSS 0.5%CVE-2026-13064HIGHMongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of ServiceEPSS 0.5%CVE-2026-19630HIGHAmplified resource exhaustion in inbound message processingEPSS 0.4%CVE-2026-34230MEDIUMRack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerEPSS 0.4%CVE-2026-63448MEDIUMSuricata smb: some SMB flows can cause resource exhaustionEPSS 0.4%CVE-2026-28804MEDIUMpypdf: Inefficient decoding of ASCIIHexDecode streamsEPSS 0.4%CVE-2026-44639LOWNanoMQ: O(N²) Denial of Service in MQTT v5 Property ParsingEPSS 0.4%CVE-2026-45664MEDIUMImageMagick: Policy Bypass in MNG coder couldEPSS 0.4%CVE-2026-115352HIGHMistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline ParserEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-42304HIGHTwisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer ChainsEPSS 0.4%CVE-2026-107576HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.4%CVE-2026-102277MEDIUMbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceEPSS 0.4%