Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-42504HIGHQuadratic complexity in WordDecoder.DecodeHeader in mimeEPSS 0.6%CVE-2024-39702MEDIUMIn lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash DenEPSS 0.6%CVE-2026-48959HIGHIO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForwardEPSS 0.6%CVE-2026-111758HIGHmarkdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)EPSS 0.5%CVE-2026-56860MEDIUMAvoid quadratic complexity in resolvePath in net/urlEPSS 0.5%CVE-2026-112891MEDIUMPillow: Quadratic GIF comment copying during saveEPSS 0.5%CVE-2025-24946MEDIUMThe hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a consideEPSS 0.5%CVE-2026-84375HIGHjs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesEPSS 0.5%CVE-2026-119195HIGHpyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decodingEPSS 0.5%CVE-2026-70453HIGHrsync < 3.5.0 Algorithmic Complexity DoS via hash_search()EPSS 0.5%CVE-2026-82398MEDIUMpypdf: Inefficient handling of non-whitespace inputs in read_until_whitespaceEPSS 0.5%CVE-2026-82729MEDIUMQuadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoSEPSS 0.5%CVE-2026-92365MEDIUMvllm-project vllm thinking_budget_state.py algorithmic complexityEPSS 0.5%CVE-2026-81722HIGHnltk PorterStemmer before 3.10.3 Quadratic-time DoSEPSS 0.5%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.5%CVE-2026-16762HIGHDenial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts QtEPSS 0.5%CVE-2026-86429HIGHcommonmark before 2.9.1 Denial of Service via SmartPunct and AttributesEPSS 0.5%CVE-2026-49250HIGHConform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsEPSS 0.5%CVE-2026-86434HIGHcommonmark 2.0.0 through 2.8.3 Denial of Service via Slug CollisionEPSS 0.5%CVE-2026-86433HIGHcommonmark 1.5.0 before 2.8.4 Denial of Service via AttributesEPSS 0.5%