Fallos del tipo CWE-407

270 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-111766LOWmarkdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledEPSS 0.4%CVE-2026-107574HIGHInefficient Algorithmic Complexity in hMailServerEPSS 0.4%CVE-2026-119197HIGHpyasn1: Quadratic-complexity denial of service in binary REAL decodingEPSS 0.4%CVE-2026-119196HIGHpyasn1: Quadratic CPU consumption in constructed BIT STRING decodingEPSS 0.4%CVE-2026-119194HIGHpyasn1: Quadratic CPU use in schemaless BER/CER/DER container decodingEPSS 0.4%CVE-2019-25781HIGHPython-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket ParsingEPSS 0.4%CVE-2026-62160HIGHDaptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareEPSS 0.4%CVE-2026-53550MEDIUMjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliasesEPSS 0.4%CVE-2026-42245LOWnet-imap: Quadratic complexity when reading response literalsEPSS 0.4%CVE-2026-115347HIGHMistune before 3.3.0 Quadratic Denial of Service via parse_link_textEPSS 0.4%CVE-2026-115585HIGHpypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)EPSS 0.4%CVE-2026-78661HIGHAvoid quadratic complexity when coalescing text nodes in html in golang.org/x/netEPSS 0.4%CVE-2026-110755HIGHText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getlineEPSS 0.4%CVE-2026-48516MEDIUMMessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsEPSS 0.4%CVE-2026-48511MEDIUMMessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsEPSS 0.4%CVE-2026-102461HIGHIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an EPSS 0.4%CVE-2026-104844MEDIUMPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionEPSS 0.4%CVE-2026-107297MEDIUMmsgpack5: Quadratic parsing in the streaming decoderEPSS 0.4%CVE-2026-41850HIGHSpring Framework Algorithmic Denial of Service via SpEL ExpressionsEPSS 0.4%CVE-2026-107575MEDIUMInefficient Algorithmic Complexity in hMailServerEPSS 0.4%