Weaknesses of type CWE-407

270 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2026-111766LOWmarkdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledEPSS 0.4%CVE-2026-107574HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.4%CVE-2026-119197HIGHpyasn1: Quadratic-complexity denial of service in binary REAL decodingEPSS 0.4%CVE-2026-119196HIGHpyasn1: Quadratic CPU consumption in constructed BIT STRING decodingEPSS 0.4%CVE-2026-119194HIGHpyasn1: Quadratic CPU use in schemaless BER/CER/DER container decodingEPSS 0.4%CVE-2019-25781HIGHPython-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket ParsingEPSS 0.4%CVE-2026-62160HIGHDaptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareEPSS 0.4%CVE-2026-53550MEDIUMjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesEPSS 0.4%CVE-2026-42245LOWnet-imap: Quadratic complexity when reading response literalsEPSS 0.4%CVE-2026-115347HIGHMistune before 3.3.0 Quadratic Denial of Service via parse_link_textEPSS 0.4%CVE-2026-115585HIGHpypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)EPSS 0.4%CVE-2026-78661HIGHAvoid quadratic complexity when coalescing text nodes in html in golang.org/x/netEPSS 0.4%CVE-2026-110755HIGHText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getlineEPSS 0.4%CVE-2026-48516MEDIUMMessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsEPSS 0.4%CVE-2026-48511MEDIUMMessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsEPSS 0.4%CVE-2026-102461HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an EPSS 0.4%CVE-2026-104844MEDIUMPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionEPSS 0.4%CVE-2026-107297MEDIUMmsgpack5: Quadratic parsing in the streaming decoderEPSS 0.4%CVE-2026-41850HIGHSpring Framework Algorithmic Denial of Service via SpEL ExpressionsEPSS 0.4%CVE-2026-107575MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.4%