CVE-2026-55620 eml_parser: DoS via deeply nested parens in Received headers

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...

CVE-2026-58436

A flaw was found in Gitea. An unauthenticated remote attacker could exploit a quadratic-time algorithm in the ParseAcceptLanguage function, specifically within the Locale middleware. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumptio...

SUSE CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

SUSE CVE-2026-56860

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

AZL-98706 CVE-2026-56860 affecting package golang 1.27.1-1

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

AZL-96665 CVE-2026-56860 affecting package golang 1.26.7-1

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

CVE-2026-56860

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the hashsearch function. An attacker can exhaust CPU resources by sending a specially crafted file list that triggers worst-case quadratic-time behavior in hash lookups. Remediation A fix was...

CVE-2026-58436

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436

CVE-2026-58436 describes a quadratic-time DoS in Gitea related to parsing the Accept-Language header via the Locale middleware, affecting unauthenticated requests. The available connected sources (NVD, CVE lists, OSV entries, and CIRCL sighting) consistently state the issue as a parsing-based DoS...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-58436 ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

AZL-95855 CVE-2026-70453 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

CVE-2026-70453

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hashsearch function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receive...

python: Python: Performance degradation in XML processing due to quadratic time complexity

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service DoS when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall and Element.iterfind can cause the processing...

PT-2026-71898

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Resolving relative paths containing parent directory '..' segments previously performed string conversions and buffer rewrites at each step. This process resulte...

CVE-2026-73413

Shescape (JavaScript library) contains a quadratic-time denial-of-service vulnerability in the flag-protection path. From versions 2.1.11 through 2.1.14 and 3.0.1, the flag-protection loop in compose.js repeatedly joins and slices flag fragments when flagProtection is enabled (default), causing p...

CVE-2026-73413 Shescape: Quadratic-time denial of service in flag-protection

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is the default, making processing quadratic in input size...