Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
CVE-2026-42504
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
#cwe-407
共收录 257 条相关情报。
← 返回所有主题Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line ...
CVE-2026-8594
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.
Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could cause quadratic behavior in the parser, resulting in a de...
CVE-2026-44378
Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encodings in BER data could
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the o...
CVE-2026-48959
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastFo
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets that Unbound needs to perform name compression for. Malici...
CVE-2026-44390
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets t
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take ...
CVE-2026-42923
NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sendi...
CVE-2026-41292
NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsin
ImageMagick: Policy Bypass in MNG coder could
CVE-2026-45664
Because of a missing check in the MNG coder it would be possible to read more images than the list limit policy would al
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) at...
CVE-2026-42304
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.n
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows...
CVE-2026-45186
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-45186
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic t...
CVE-2026-42245
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5
Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service via quadratic fragment-name uniqueness validation. 'Elixi...
CVE-2026-43967
Inefficient Algorithmic Complexity vulnerability in absinthe-graphql absinthe allows unauthenticated denial of service v
hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n²) name compression
During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compressi
Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
CVE-2026-42304
### Details The twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during D
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
## Summary `OverlappingFieldsCanBeMerged` validation rule has `O(n^2 x m^2)` worst case via flattened inline fragments.
net-imap has quadratic complexity when reading response literals
CVE-2026-42245
### Summary `Net::IMAP::ResponseReader` has quadratic time complexity when reading large responses containing many stri