CVE-2026-67216 cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

CVE-2026-67216 cJSON cJSON_Compare Exponential Complexity Denial of Service

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

Weblate: Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate

A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the pyparsing library. The grammar was ambiguous at every position and did not enable memoization,...

CVE-2026-67216: Inefficient Algorithmic Complexity

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSONCompare. When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested documen...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

BIT-ELASTICSEARCH-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

Inefficient Algorithmic Complexity

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and...

GHSA-PM4M-PH32-GHV5 js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

js-yaml: Exponential parsing time in flow collections leads to denial of service

Summary Parsing a small YAML document can take exponential time. An application that calls load or loadAll on untrusted input can be hung by a payload under 200 bytes. Details When an entry in a flow sequence turns out to be a key: value pair, the parser rewinds and parses that entry a second tim...

PT-2026-71720

Name of the Vulnerable Software and Affected Versions js-yaml versions 5.0.0 through 5.2.1 Description Parsing a small YAML document can lead to exponential time consumption when an application calls the load or loadAll functions on untrusted input. In the src/parser/parser.ts file, the...

EUVD-2026-47591

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263

CVE-2026-63263 affects Elasticsearch’s ES|QL engine, where an authenticated user can submit a crafted query that triggers exponential CPU consumption during evaluation, causing uncontrolled resource exhaustion. The impact is denial of service as query worker resources become exhausted and ES|QL q...

CVE-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-74)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that...