devalue: Residual sparse-array CPU amplification in uneval
`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker
#cwe-407
共收录 257 条相关情报。
← 返回所有主题pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_d...
CVE-2026-102999
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files c
pypdf: Possible long runtimes with large amount of embedded files
CVE-2026-102999
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files c
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
### Summary Expanding `{a},b}`-shaped input takes time quadratic in the number of literal `}` characters, blocking the
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
### Summary When `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free t
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity propor...
CVE-2026-42772
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out o
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {...
CVE-2026-102277
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free...
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attacker...
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter
nodemailer before 10.0.6 Denial of Service via addressparser
CVE-2026-100700
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex patter
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
CVE-2026-56669
Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. El
Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-61814
`AsyncParser` can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each abs...
CVE-2026-61814
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON tok
Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-61814
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON tok
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID ...
CVE-2026-65634
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated atta
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. to_ascii punycode ...
CVE-2026-87081
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode. The XS backend inserts each d...
CVE-2026-87079
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
CVE-2026-87081
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode
CVE-2026-87079
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/...
CVE-2026-71418
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr