Shescape: Quadratic-time denial of service in the flag-protection

Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. javascript import Shescape from "shescape"; // 1. Prerequisit...

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...

GHSA-FW57-JGCH-PGF3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...

Gitea SSH Key Parser Denial of Service

Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 SSH2 format and normalises them before storage. The normalisation function contains an ON² string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work th...

GHSA-8PPF-4F7H-5PPJ pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload tens of kilobytes containing an OID with many arcs consumes seconds of CPU per decode call, allowing denial of service in any application tha...

PT-2026-63284

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 SSH2 public key to the SSH key ingestion endpoint. The issue stems from a normalization function...

GHSA-C8J7-8CV4-2XMQ Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Summary Type: Algorithmic-complexity denial of service. A run of N closed pairs xx... or the analogous ==x== for mark, ^^x^^ for insert causes ON² work in the formatting parser. With the strikethrough, mark, or insert plugin enabled, an 8 KB input pegs the CPU for 4 seconds; 16 KB → 17 seconds...

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Summary Type: Algorithmic-complexity denial of service. A run of N closed pairs xx... or the analogous ==x== for mark, ^^x^^ for insert causes ON² work in the formatting parser. With the strikethrough, mark, or insert plugin enabled, an 8 KB input pegs the CPU for 4 seconds; 16 KB → 17 seconds...

GHSA-4J32-57V6-6G45 Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Summary Type: Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed x strong or x strong-emphasis combined pairs causes ON² parser work. Distinct from the bracket-bomb DoS repetition and from the formatting-plugin DoS /==/^^; this one fires on default-config mistune...

GHSA-FFQ3-XPV3-J92Q Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Summary Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key or many distinct keys takes ON² parser time. 5000 repeated a: u\n definitions take 1.1 second; 10000 → 4.5 seconds. File: src/mistune/blockparser.p...

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Summary Type: Algorithmic-complexity DoS in reference-link definition handling. A markdown document with N reference-link definitions of the same key or many distinct keys takes ON² parser time. 5000 repeated a: u\n definitions take 1.1 second; 10000 → 4.5 seconds. File: src/mistune/blockparser.p...

EUVD-2026-42302

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml...

NPM: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

NPM: js-yaml: Quadratic-complexity On^2 DoS via !!omap tag in YAML11SCHEMA vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.0...

GHSA-724G-MXRG-4QVM js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

Summary js-yaml v5.x introduces YAML11SCHEMA support with the !!omap ordered map tag. The omapTag.addItem function performs a linear On scan for duplicate key detection on every insertion, resulting in On^2 total time to parse a document with n omap entries. An attacker can send a small crafted...

Tornado: Quadratic DoS via Repeated Header Coalescing

Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...

SUSE CVE-2026-59885

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode call and c...

SUSE CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

CVE-2026-48801

Linkify-it (linkify-it) prior to version 5.0.1 has an O(N^2) scan loop in LinkifyIt.prototype.match, making inputs with many fuzzy links or emails vulnerable to resource exhaustion on a request hot path that renders untrusted Markdown with linkify: true. The issue arises from re-slicing input and...

PYSEC-2026-3456

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode call and c...