CWE-407: Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
144 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-34573 — Parse Server: GraphQL complexity validator exponential fragment traversal DoS
- CVE-2026-3276 — Potential DoS via quadratic complexity in unicodedata.normalize()
- CVE-2026-3988 — Inefficient Algorithmic Complexity in GitLab
- CVE-2026-31937 — Suricata dcerpc: quadratic complexity in dcerpc buffering
- CVE-2026-31934 — Suricata smtp/mine: quadratic complexity in extracting urls
- CVE-2026-31933 — Suricata stream: quadratic complexity in stream inspection
- CVE-2026-31932 — Suricata krb5: quadratic complexity in krb5 buffering
- CVE-2025-62727 — Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse
- CVE-2025-11230 — Denial of service vulnerability in HAProxy mjson library
- CVE-2024-9631 — Inefficient Algorithmic Complexity in GitLab
- CVE-2026-66046 — Expat Denial of Service via storeAtts() Quadratic Complexity
- CVE-2026-49851 — Mistune: Potential DoS via quadratic-time parsing in parse_link_text
- CVE-2026-83613 — xmldom: Quadratic-time attribute deduplication
- CVE-2026-59094 — Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store
- CVE-2026-86435 — commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
- CVE-2026-86430 — league/commonmark before 2.9.1 Denial of Service via parsing
- CVE-2026-87822 — t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
- CVE-2026-86434 — commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
- CVE-2026-86433 — commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
- CVE-2026-86429 — commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
Recently published
- CVE-2026-87822 — t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
- CVE-2024-58382 — league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity
- CVE-2023-54395 — PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket
- CVE-2026-86435 — commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
- CVE-2026-86434 — commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
- CVE-2026-86433 — commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
- CVE-2026-86430 — league/commonmark before 2.9.1 Denial of Service via parsing
- CVE-2026-86429 — commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
- CVE-2026-86428 — commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes
- CVE-2026-82729 — Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS
- CVE-2026-85446 — MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service
- CVE-2026-71429 — stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
- CVE-2026-84378 — HTTPX2: Quadratic SSE line buffering can cause CPU denial of service
- CVE-2026-84375 — js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
- CVE-2026-84305 — sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
- CVE-2026-49329 — Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
- CVE-2026-83614 — xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
- CVE-2026-83613 — xmldom: Quadratic-time attribute deduplication
- CVE-2026-82398 — pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
- CVE-2026-77831 — Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
More specific weaknesses
- CWE-1333 — Inefficient Regular Expression Complexity