CWE-407: Inefficient Algorithmic Complexity, page 6
Filter
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
What the weakness is: CWE-407 at MITRE
Ask an AI about CWE-407
Show the prompt
Explain CWE-407: Inefficient Algorithmic Complexity and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/407.html and https://cve.bz/cve/cwe/407?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2024-43485EPSS 3.1%
.NET and Visual Studio Denial of Service Vulnerability
- 7.5CVE-2024-43484EPSS 3.0%
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- 7.5CVE-2024-43483EPSS 2.9%
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- 5.9CVE-2024-39702EPSS 0.6%
In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations v…
- 5.6CVE-2024-29916EPSS 0.3%
The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka …
- 7.5CVE-2023-4408EPSS 1.4%
The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `n…
- 7.5CVE-2024-23684EPSS 0.9%
Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a …
- 7.5CVE-2024-21909EPSS 1.1%
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in Peter…
- 7.5CVE-2023-46136EPSS 1.3%
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without…
- 7.5CVE-2023-38285EPSS 0.9%
Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.
- 6.5CVE-2023-36810EPSS 0.6%
pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blo…
- 4.3CVE-2023-2473EPSS 0.9%
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads…
- 7.5CVE-2023-26485EPSS 1.0%
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers q…
- 7.5CVE-2023-24824EPSS 1.0%
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers q…
- 5.5CVE-2022-36021EPSS 60%
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and cons…
- 7.5CVE-2023-22486EPSS 1.1%
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time complexity issue in handle_close_bracket that may lead to unbounded resource exhaus…
- 7.5CVE-2023-22484EPSS 1.0%
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial time complexity issue in cmark-gfm that may lead to unbounded resource exhaustion …
- 7.5CVE-2023-22483EPSS 1.1%
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynomial time complexity issues in cmark-gfm that may lead to unbounded resource exha…
- 7.5CVE-2022-45061EPSS 2.7%
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder c…
- 7.5CVE-2022-40188EPSS 1.9%
Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must return large NS sets or address sets.
- 6.5CVE-2022-39209EPSS 2.2%
cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaust…
- 7.5CVE-2022-22153EPSS 0.9%
An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series and MX Series with SPC3 allows an u…
- 6.5CVE-2021-41168EPSS 0.8%
Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. Ref…
- 7.5CVE-2021-33582EPSS 3.1%
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes s…
- 5.3CVE-2020-27223EPSS 78%
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of ser…
- 7.5CVE-2019-19331EPSS 2.1%
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficiently, in extreme cases taking even several CPU seconds for eac…
- 7.5CVE-2018-12558EPSS 2.6%
The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-fie…
- 7.5CVE-2017-11343EPSS 0.9%
Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide crafted input which, when inserted into the symbol table, wil…
- 7.5CVE-2016-10396EPSS 2.9%
The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remote attacker to exhaust computational resources on the remote…