12 matches found
CVE-2026-49329 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-'...
CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...
CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...
CVE-2026-83613
xmldom , a pure JavaScript W3C XML DOM parser, is affected by a quadratic-time complexity flaw in DOMHandler.startElement (lib/dom-parser.js). Each parsed attribute is inserted via setAttributeNode, which triggers a linear getNamedItem/getNamedItemNS lookup in NamedNodeMap.setNamedItem (lib/dom.j...
CVE-2026-83613 xmldom: Quadratic-time attribute deduplication
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode...
CVE-2026-81722
nltk PorterStemmer in versions ≤ 3.10.2 is vulnerable to an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The root cause is that the _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for ea...
CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS
nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...
CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS
nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...
CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
CVE-2026-58436
CVE-2026-58436 describes a quadratic-time DoS in Gitea related to parsing the Accept-Language header via the Locale middleware, affecting unauthenticated requests. The available connected sources (NVD, CVE lists, OSV entries, and CIRCL sighting) consistently state the issue as a parsing-based DoS...