commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes
CVE-2026-86428
commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when p
#cwe-407
共收录 257 条相关情报。
← 返回所有主题Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parse_hex_pref...
CVE-2026-82729
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the c
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms...
CVE-2026-85446
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node ident
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distrib...
CVE-2026-85446
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node ident
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and rep...
CVE-2026-71429
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
CVE-2026-71429
## Description The path filters `pick`, `ignore`, `filter`, and `replace` — the library's headline "surgical extraction
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buff...
CVE-2026-84378
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
CVE-2026-84378
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sour...
CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/load
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
CVE-2026-84305
### Summary When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the curr
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
### Impact `AttributesExtension` ships with the library but must be explicitly registered on the `Environment`; it is n
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
### Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitl
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
### Impact Affected versions of `league/commonmark` perform super-linear work on three independent parsing paths, all o
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized t...
CVE-2026-84305
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlfo
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
CVE-2026-84305
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlfo
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLan...
CVE-2026-49329
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Lan
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versi...
CVE-2026-83614
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versi...
CVE-2026-83613
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
CVE-2026-83614
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld