CWE-407
CVEs classified under CWE-407, newest first.
195 CVEsRSS
CVE-2026-117540High· 7.5svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping P…
CVE-2026-116872High· 7.5Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long searc…
GHSA-4g23-2xm8-66gcMedium· 5.9Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
CVE-2026-116587High· 7.5Go JOSE: DoS when parsing JWKs that contain RSA keys
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-…
CVE-2026-65631Medium· 6.9erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the pu…
CVE-2026-116577Medium· 5.3Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on th…
CVE-2026-113436High· 8.7Quadratic bignum parsing of Content-Length and Host port values in Bandit
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of …
CVE-2026-108529High· 8.7SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker ope…
GHSA-f2hq-32vh-53ccHigh· 7.5postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
CVE-2026-115585High· 7.1pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
CVE-2026-89314Medium· 6.9Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized b…
CVE-2026-16762High· 8.7Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only tha…
CVE-2026-115352High· 7.5Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown p…
CVE-2026-115347High· 7.5Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing lon…
CVE-2026-75507High· 7.5GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules repeatedly compares fields that share response names and recursively…
CVE-2026-115319Low· 2.5github.com/junegunn/fzf: fzf: Denial of Service via inefficient string concatenation (CVE-2026-115319)
A flaw was found in fzf. Inefficient string concatenation in the maskActionContents function allows a local attacker to cause a Denial of Service (DoS). By repeatedly sending large HTTP requests to the local server, an attacker can block t…
CVE-2026-114143High· 8.7toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114129Medium· 6.2stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
CVE-2026-113789Medium· 6.0pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypdf: Possible long runtimes/large memory usage when retrieving form fields
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
A flaw was found in Pillow. When appending images to an existing PDF document, the PDF parser does not track duplicate indirect references within the page structure. A remote attacker can provide a specially crafted PDF file containing rep…
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex para…
CVE-2026-114141High· 8.7toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-t…
CVE-2026-96643High· 7.1Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf…
CVE-2026-19630High· 7.5Amplified resource exhaustion in inbound message processing
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consu…
CVE-2026-112894High· 7.5PoCPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-112401Medium· 6.9Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
CVE-2026-112891Medium· 6.9Pillow: Quadratic GIF comment copying during save
Pillow: Quadratic GIF comment copying during save
CVE-2026-113729High· 7.5Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference dig…
CVE-2026-111758High· 7.5markdown-it: markdown-it: Denial of Service via unclosed link reference definitions (CVE-2026-111758)
A flaw was found in markdown-it. A remote attacker can cause a Denial of Service (DoS) by providing specially crafted Markdown input that contains an unclosed link reference definition spanning multiple lines. Processing this input trigger…
CVE-2026-111759High· 7.5PoCmarkdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes