Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submi...

CVE-2026-72663

Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-

历史摘要 · 未重新核验 · NVD

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on ...

CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponenti

历史摘要 · 未重新核验 · NVD

js-yaml: Exponential parsing time in the flow collections leads to denial of service

CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponenti

历史摘要 · 未重新核验 · OSV.dev

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

历史摘要 · 未重新核验 · NVD

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

历史摘要 · 未重新核验 · OSV.dev

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a care...

CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote a

历史摘要 · 未重新核验 · NVD

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and...

CVE-2026-73413

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop i

历史摘要 · 未重新核验 · NVD

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic comple...

CVE-2026-71848

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the langua

历史摘要 · 未重新核验 · NVD

Hono: Algorithmic Complexity DoS in Language Middleware

CVE-2026-71848

### Summary The `languageDetector` middleware is vulnerable to algorithmic complexity denial of service when processing

历史摘要 · 未重新核验 · GitHub Advisory

Hono: Algorithmic Complexity DoS in Language Middleware

CVE-2026-71848

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the langua

历史摘要 · 未重新核验 · OSV.dev

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially craf

历史摘要 · 未重新核验 · NVD

league/commonmark: Denial of service via colliding heading slugs

### Impact `UniqueSlugNormalizer::normalize()` makes each slug document-unique by searching for an unused numeric suffi

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Denial of service via duplicate footnote definitions

### Impact The Footnote extension records one backref per footnote *reference* and then appends the **entire** backref

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Denial of service via adjacent inline attribute blocks

### Impact With the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribut

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

CVE-2026-71488

### Impact Affected versions of `league/commonmark` can have quadratic time complexity when parsing specially crafted M

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially craf

历史摘要 · 未重新核验 · OSV.dev

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x) ## Summary `resolveYamlOmap()` enforces key u

历史摘要 · 未重新核验 · GitHub Advisory

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU and memory vi...

CVE-2026-68750

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenti

历史摘要 · 未重新核验 · NVD

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

CVE-2026-68750

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenti

历史摘要 · 未重新核验 · OSV.dev

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes at...

CVE-2026-71321

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island ren

历史摘要 · 未重新核验 · NVD