CVE-2026-71429: Inefficient Algorithmic Complexity

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token...

EUVD-2026-67072

NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'...

CVE-2026-84378: Inefficient Algorithmic Complexity

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via ReindentFilter.getoffset in sqlparse/filters/reindent.py, which reconstructed the full statement prefix from the beginning of the statement on every call. Because getoffset is invoked once per grou...

Inefficient Algorithmic Complexity

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Inefficient...

CVE-2026-81722

A flaw was found in the nltk PorterStemmer component. A remote attacker could exploit this vulnerability by providing a specially crafted, untrusted token. The inefficient algorithmic complexity in the stemming process, specifically within the isconsonant and measure helper functions, causes...

SUSE-SU-2026:3907-1 Security update for python-sqlparse

This update for python-sqlparse fixes the following issues: - CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption bsc1275459. - CVE-2026-59893: quadratic complexity when processing...

SUSE-SU-2026:3906-1 Security update for python3-sqlparse

This update for python3-sqlparse fixes the following issues: - CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessive resource consumption bsc1275459. - CVE-2026-59893: quadratic complexity when processing...

Inefficient Algorithmic Complexity

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in readuntilwhitespace in pypdf/utils.py. An attacker can trigger long runtimes by supplying a...

CVE-2026-84305: Inefficient Algorithmic Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

CVE-2026-83613: Inefficient Algorithmic Complexity

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode...

CVE-2026-49329: Inefficient Algorithmic Complexity

A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...

CVE-2026-82398: Inefficient Algorithmic Complexity

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-77831

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-77831

AshPaperTrail (an Elixir library from the ash-project ecosystem) contains an inefficient algorithmic complexity vulnerability in its full-diff list change tracking component (AshPaperTrail.ChangeBuilders.FullDiff.ListChange). The root cause is a cubic-time algorithm: when pairing prior array elem...

EUVD-2026-68144

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

EEF-CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Summary Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...

CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...