In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500...
CVE-2026-58059
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue a
#cwe-407
共收录 257 条相关情报。
← 返回所有主题In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, an...
CVE-2026-58059
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue a
Quadratic-time escaping when stringifying X.500 distinguished names
CVE-2026-58059
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue a
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once i...
CVE-2026-67216
cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML docu...
CVE-2026-6879
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index pred
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on ...
CVE-2026-55685
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauth
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
CVE-2026-55685
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauth
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default ...
CVE-2026-64644
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 thr
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 thr
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: befo...
CVE-2026-55968
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift
Shescape: Quadratic-time denial of service in the flag-protection
### Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the
Next.js: Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644
### Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely ho
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to reso...
CVE-2026-13064
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-58436
### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
CVE-2026-13311
### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
CVE-2026-59922
## Summary **Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~...` (or the analogou
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
CVE-2026-59925
## Summary **Type:** Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed `**x**` (stron
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the ...
CVE-2026-59885
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER a
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor que...
CVE-2026-57480
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-a
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data...
CVE-2026-56669
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server commun