CVE-2026-55620

eml_parser is a Python module for parsing EML files. Prior to 3.0.2 , the eml_parser.routing.noparenthesis function in eml_parser/routing.py removes parenthesized CFWS comments from Received: headers using a regex-based fix-point loop with quadratic running time in nesting depth. A single Receive...

CVE-2026-55620 eml_parser: DoS via deeply nested parens in Received headers

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

CVE-2026-58436

A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumptio...

SUSE CVE-2026-56860

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

CVE-2026-56860

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436

CVE-2026-58436 describes a quadratic-time DoS in Gitea related to parsing the Accept-Language header via the Locale middleware, affecting unauthenticated requests. The available connected sources (NVD, CVE lists, OSV entries, and CIRCL sighting) consistently state the issue as a parsing-based DoS...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

python: Python: Performance degradation in XML processing due to quadratic time complexity

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service DoS when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall and Element.iterfind can cause the processing...

PT-2026-71898

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Resolving relative paths containing parent directory '..' segments previously performed string conversions and buffer rewrites at each step. This process resulte...

CVE-2026-73413

Shescape (JavaScript library) contains a quadratic-time denial-of-service vulnerability in the flag-protection path. From versions 2.1.11 through 2.1.14 and 3.0.1, the flag-protection loop in compose.js repeatedly joins and slices flag fragments when flagProtection is enabled (default), causing p...

CVE-2026-73413 Shescape: Quadratic-time denial of service in flag-protection

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

EUVD-2026-54143

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...