CVE-2025-58187

The cri-tools and buildkitd packages are affected by CVE-2025-58187. The vulnerability stems from a design flaw in the name constraint checking algorithm , where the processing time for certain inputs scales non-linearly relative to the size of the certificate. This issue impacts any programs tha...

CVE-2025-58187 Quadratic complexity when checking name constraints in crypto/x509

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...

GO-2025-4009 Quadratic complexity when parsing some invalid inputs in encoding/pem

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs...

GO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains...

Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files e.g., StaticFiles or any use of...

GHSA-7F5H-V6XP-FCQ8 Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``

Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files e.g., StaticFiles or any use of...

CVE-2025-62727: Inefficient Algorithmic Complexity

Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion...

PT-2025-45680

Summary An unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merging logic. This enables CPU exhaustion per request, causing denial‑of‑service for endpoints serving files e.g., StaticFiles or any use of...

JLSEC-2025-175 hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via...

hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks...

CLSA-2025-1760106873 exiv2: Fix of CVE-2025-55304

CVE-2025-55304: add new method appendIccProfile to fix quadratic performance issue...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libffi (UTSA-2025-003040)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-003040 advisory. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using inttext, a system could take 50ms to parse an int string...

EUVD-2006-0050

Malware in sbrugna...

EUVD-2020-3159

Malware in sbrugna...

EUVD-2023-0947

Malicious code in bioql PyPI...

EUVD-2024-0077

Malicious code in bioql PyPI...

EUVD-2023-0326

Malicious code in bioql PyPI...

EUVD-2023-53862

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-27789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named...

CVE-2025-55304 Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata can cause Exiv2 to run for a long time...

Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Impact A denial-of-service was found in Exiv2 version v0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata can cause Exiv2 to run for a long time. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of imag...