CWE-407

Low likelihood

Inefficient Algorithmic Complexity

Parent: CWE-405 - Asymmetric Resource Consumption (Amplification)

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

90 vulnerabilities with CWE-407
CVE-2026-31933 HIGH
Suricata stream: quadratic complexity in stream inspection
CVSS 7.5
CVE-2026-31932 HIGH
Suricata krb5: quadratic complexity in krb5 buffering
CVSS 7.5
CVE-2026-34573 HIGH
Parse Server: GraphQL complexity validator exponential fragment traversal DoS
CVSS 7.5
CVE-2026-3988 HIGH
Inefficient Algorithmic Complexity in GitLab
CVSS 7.5
CVE-2026-33123 MEDIUM
pypdf has inefficient decoding of array-based streams
CVSS 6.5
CVE-2026-28804 MEDIUM
pypdf < 6.7.5 - Denial of Service via ASCIIHexDecode Filter
CVSS 5.3
CVE-2026-27903 HIGH
minimatch < 10.2.3 DoS via Globstar Pattern Backtracking
CVSS 7.5
CVE-2026-1285 HIGH
Django 4.2-4.2.27, 5.2-5.2.10, 6.0-6.0.1 - Denial of Service via Unmatched HTML End Tags
CVSS 7.5
CVE-2025-67841 HIGH
Nordic Semiconductor IronSide SE <23.0.2+17 - DoS
CVSS 7.5
CVE-2025-14831 MEDIUM
GnuTLS - Denial of Service
CVSS 5.3
CVE-2025-14550 HIGH
Django 4.2-4.2.27, 5.2-5.2.10, 6.0-6.0.1 - Denial of Service via Duplicate ASGI Headers
CVSS 7.5
CVE-2025-14822 LOW
Mattermost 10.11.0-10.11.8 - Authenticated Denial of Service via Hashtag Processing
CVSS 3.1
CVE-2025-12084 MEDIUM
Python < 3.13.11 - Denial of Service via Quadratic Complexity in xml.dom.minidom
CVSS 5.3
CVE-2025-64460 HIGH
Django 4.2-4.2.26 5.1-5.1.14 5.2a1-5.2.8 - Denial of Service via XML Deserializer
CVSS 7.5
CVE-2025-66382 LOW
libexpat < 2.7.3 - Denial of Service via Crafted File Processing
CVSS 2.9
CVE-2025-11230 HIGH
HAProxy Aloha Appliance 14.5.0-14.5.32 and HAProxy 2.4.0-2.4.29 - Denial of Service via mjson JSON Request Parsing
CVSS 7.5
CVE-2025-64458 HIGH
Django 4.2-4.2.25, 5.1-5.1.13, 5.2-5.2.7 - Denial of Service via NFKC Unicode Normalization
CVSS 7.5
CVE-2025-58187 HIGH
Certificate Validation - Info Disclosure
CVSS 7.5
CVE-2025-62727 HIGH
Starlette 0.39.0-0.49.0 - Unauthenticated Denial of Service via HTTP Range Header
CVSS 7.5
CVE-2025-55304 MEDIUM
Exiv2 < 0.28.6 - Denial of Service via Crafted JPEG ICC Profile
CVSS 5.5
CVE-2025-27209 HIGH
Node.js 24.0.0-24.4.0 - Denial of Service via Hash Collision in String Hashing
CVSS 7.5
CVE-2025-29908 MEDIUM
Netty QUIC codec <0.0.71. Final - Hash DoS
CVSS 5.3
CVE-2025-30348 MEDIUM
Qt < 5.15.19 - Inefficient Algorithmic Complexity in QDom encodeText
CVSS 5.8
CVE-2025-24947 MEDIUM
LSQUIC < 4.2.0 - Denial of Service via Hash Collision in Connection ID Hash Table
CVSS 5.3
CVE-2025-24946 MEDIUM
picoquic < b80fd3f5903279ae3e7714ee4109363d9ab4491a - Denial of Service via Hash Table Collision
CVSS 5.3
Details
Vulnerabilities 90
Exploit Likelihood Low
Links
MITRE CWE Entry Search this CWE With Exploits