1270 matches found
CVE-2026-84378
HTTPX2 , a next-generation HTTP client for Python, is affected by a quadratic CPU denial-of-service vulnerability in its Server-Sent Events (SSE) parser. Versions from 2.5.0 through 2.10.0 are impacted. The root cause lies in _SSELineDecoder.decode() in src/httpx2/httpx2/_sse.py, which repeatedly...
CVE-2026-84378 HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...
CVE-2026-84378 HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
EUVD-2026-68894
pypdf: Inefficient handling of non-whitespace inputs in readuntilwhitespace...
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...
GHSA-WW6M-CW3F-Q94G NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
nltk.stem.PorterStemmer.stem -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in On^2 time on a token containing a long run of the letter 'y', letting a single 20-50 KB token pin a CPU core CWE-407. Root cause isconsonantword, i was made iterative commit for 3633,...
EUVD-2026-67073
NLTK: Quadratic CPU Exhaustion in XMLCorpusView.readxmlfragment...
GHSA-VP2X-QP44-57V7 NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`
Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
net/mail: golang: net/mail: Denial of Service via pathological email address parsing
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...