CVE-2026-102990

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RELINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group field...

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.1.0...

tornado: Tornado Quadratic DoS via Crafted Multipart Parameters

A denial of service flaw has been discovered in the Tornado networking library. Affected versions of Tornado us an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The parseparam function in httputil.py is used to parse specific HTTP header values,...

AZL-47860 CVE-2024-7592 affecting package python3 for versions less than 3.9.19-4

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resourc...