CWE-407

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote a

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function use

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in

Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters.

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representation

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Uni

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encodi

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets t

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithm

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 thr

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the langua

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 f

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/icon

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in th

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can cr

Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authentica

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via

unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' produci

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time comple

Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unboun

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryptio

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-a

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via C

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index pred

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue a

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop i

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the defau

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large arr

knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with ver

The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specia

The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and

Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to