xmldom: Quadratic-time attribute deduplication
CVE-2026-83613
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmld
#cwe-407
共收录 257 条相关情报。
← 返回所有主题pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whit...
CVE-2026-82398
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long r
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
CVE-2026-45822
### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this packa
Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action t...
CVE-2026-77831
CVE-2026-77831 是 ash-project 的 ash_paper_trail 组件中存在的一处低效算法复杂度漏洞。该组件用于为 Elixir 的 Ash 框架提供数据变更审计追踪功能，在启用完整差异（full-diff）变更
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper w...
CVE-2026-81722
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv
nltk PorterStemmer before 3.10.3 Quadratic-time DoS
CVE-2026-81722
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count ro...
CVE-2026-75005
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a...
CVE-2026-77680
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 f
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py c...
CVE-2026-55099
icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Comp
icalendar has Algorithmic Complexity in Equality
CVE-2026-55099
### Summary `Component.__eq__` compares subcomponents in `O(2^n)` time relative to nesting depth. Because the parser ac
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka...
CVE-2026-76401
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representation
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp ex...
CVE-2026-76401
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representation
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the p...
CVE-2026-75596
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the defau
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified...
CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAt
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
CVE-2026-54284
### Summary `sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS=10000`) intended to bound pars
sqlparse: Quadratic O(n²) DoS in group_comments
CVE-2026-71491
### Summary A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS). ### Details Location: [sqlparse/
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time compl...
CVE-2026-56860
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to...
CVE-2026-72685
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input...
CVE-2026-72663
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing...
CVE-2026-72685
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu