Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-89314MEDIUMQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEPSS 0.4%CVE-2026-116577MEDIUMTornado: Quadratic CPU usage when parsing HTTP headers with line foldingEPSS 0.4%CVE-2026-107378HIGHCairoSVG: Quadratic-time DoS parsing a crafted SVG <path>EPSS 0.4%CVE-2026-76401MEDIUMRegular Expression Denial of Service (DoS) through the REST API in Splunk Connect for KafkaEPSS 0.4%CVE-2026-87081HIGHNet::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_asciiEPSS 0.4%CVE-2026-87079HIGHNet::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycodeEPSS 0.4%CVE-2026-53433MEDIUMDenial of Service in fzfEPSS 0.4%CVE-2026-101021HIGHJ4Care dcm4che Inefficient Algorithmic ComplexityEPSS 0.4%CVE-2026-118036HIGHUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question AnsweringEPSS 0.4%CVE-2026-75596HIGHNetty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-67419HIGHRabbitMQ: Consecutive topic wildcards cause combinatorial routing workEPSS 0.4%CVE-2026-96643HIGHPillow: PNG eXIf chunk makes EXIF parsing run in quadratic timeEPSS 0.4%CVE-2025-30348MEDIUMencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with reEPSS 0.4%CVE-2026-72685MEDIUMInefficient Algorithmic Complexity in Elasticsearch Leading to Denial of ServiceEPSS 0.4%CVE-2026-86349MEDIUMMattermost Server Algorithmic DoS via Unbounded Markdown Block NestingEPSS 0.4%CVE-2026-12882MEDIUMMattermost Markdown autolink parsing denial of serviceEPSS 0.4%CVE-2026-116587HIGHGo JOSE: DoS when parsing JWKs that contain RSA keysEPSS 0.4%CVE-2026-40164HIGHjq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedEPSS 0.4%CVE-2026-31933HIGHSuricata stream: quadratic complexity in stream inspectionEPSS 0.4%