Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

CVE-2026-58059: Inefficient Algorithmic Complexity

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

AZL-94407 CVE-2026-67216 affecting package apparmor 3.1.7-1

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216: Inefficient Algorithmic Complexity

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

ROS-20260729-73-0003

The vulnerability in python-PyPDF2 is related to algorithmic complexity. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2026-55968

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-55968: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-64644: Inefficient Algorithmic Complexity

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If...

Siemens SIMATIC S7-1500 CPU 1518 MFP Inefficient Algorithmic Complexity (CVE-2026-45186)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505564; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-65623

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through inefficient route matching in the manifest endpoint. An attacker can cause excessive server load and degrade response times by sending unauthenticated targeted requests. Note: This is only...

CVE-2026-48801: Inefficient Regular Expression Complexity

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

ROS-20260713-73-0014

The vulnerability is related to algorithmic complexity. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

ROS-20260710-73-0015

The vulnerability of the Go programming language’s MIME component is related to its algorithmic complexity. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using a specially created MIME header...

CVE-2026-55206

CVE-2026-55206 (py7zr) affects the Python-based 7z library py7zr. The root cause is an O(n^2) cumulative-sum implementation in PackInfo._read() (archiveinfo.py) that parses attacker-controlled numstreams from archive headers. This causes excessive CPU usage during SevenZipFile.init() before extra...

CVE-2026-59928: Inefficient Algorithmic Complexity

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

CVE-2026-57480: Inefficient Algorithmic Complexity

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the...

CVE-2026-59922: Inefficient Algorithmic Complexity

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from ea...

CVE-2026-56669: Inefficient Algorithmic Complexity

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of...