NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

EUVD-2026-69421

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

CVE-2026-49329

A flaw in openshift/oauth-server allows an unauthenticated attacker to trigger a quadratic-time denial of service by sending a crafted Accept-Language header using '_' separators to the OAuth login and error page endpoints. The root cause is a bypass of the CVE-2022-32149 mitigation : the upstrea...

the-sanitizer-is-the-weapon-cve-2026-68749-cve-2026-68750-quadratic-dos-in-elixir-html-sanitize-ex

CVE-2026-68749 / CVE-2026-68750 — PoC Denial of service quadratico in htmlsanitizeex 1.5.3. La libreria esiste per neutralizzare HTML non attendibile, ma due percorsi di codice super-lineari indipendenti consentono a una singola richiesta costruita ad arte di bloccare uno scheduler BEAM per...

Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-ww6m-cw3f-q94g. This link is maintained to preserve external references. Original Description nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of...

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...

CVE-2026-71491 sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

GO-2026-6055 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests in gitea.dev

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests in gitea.dev...

CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and .match can be invoked at every mailto: occurrence and scan the remaining input through srcemailname in lib/re.mjs, causing On^2 CPU consumption on crafted user text...

CVE-2026-48988 markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic On^2 processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt, which performs On slicing and...

GHSA-6V5V-WF23-FMFQ markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

Summary A quadratic time complexity vulnerability exists in markdown-it's smartquotes rule enabled via the typographer: true option. An attacker can craft a markdown input consisting of consecutive quotation marks that causes the parser to consume excessive CPU time, leading to denial of service...

AlmaLinux 8 : pcs (ALSA-2026:0930)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0930 advisory. tornado: Tornado Quadratic DoS via Repeated Header Coalescing CVE-2025-67725 tornado: Tornado Quadratic DoS via Crafted Multipart Parameters CVE-2025-6772...

AZL-43210 CVE-2024-3651 affecting package python-pip for versions less than 24.0-2

A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...