Weaknesses of type CWE-407

115 results

Complexidade algorítmica ineficiente

O código usa um algoritmo cuja complexidade temporal ou espacial é muito alta para os dados que processa, permitindo que um atacante cause negação de serviço alimentando entradas que forçam o pior caso de desempenho. Exemplos comuns são buscas lineares onde buscas binárias seriam apropriadas, ou regex catastrófico que explora backtracking excessivo.

Example

Um validador de email usando regex com grupos aninhados descontrola processamento CPU ao receber strings malformadas longas; ou um servidor que processa listas de dados com dois loops aninhados O(n²) quando n pode chegar a milhões, permitindo travar o serviço com uma requisição.

How to mitigate

Escolha estruturas de dados e algoritmos apropriados ao tamanho esperado dos dados (use hash maps em vez de arrays lineares, ordene antes de buscar). Para entradas não confiáveis, implemente timeouts, limite de tamanho de entrada e teste regex com ferramentas de detecção de backtracking.

CVE-2020-27223MEDIUMIn Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple AcceptEPSS 78.0%CVE-2022-36021MEDIUMRedis string pattern matching can be abused to achieve Denial of ServiceEPSS 59.7%CVE-2024-43485HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 3.1%CVE-2024-43484HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2024-43483HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.9%CVE-2022-45061HIGHAn issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDEPSS 2.4%CVE-2019-19331HIGHknot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource recoEPSS 2.2%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.1%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2022-40188HIGHKnot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During EPSS 1.6%CVE-2023-4408HIGHParsing large DNS messages may cause excessive CPU loadEPSS 1.3%CVE-2024-12243MEDIUMGnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dosEPSS 1.2%CVE-2023-22486LOWcmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of serviceEPSS 1.1%CVE-2026-55968HIGHApache Thrift: Node.js quadratic-time DoS in server receive transportsEPSS 1.1%CVE-2023-46136HIGHWerkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningEPSS 1.1%CVE-2024-12133MEDIUMLibtasn1: inefficient der decoding in libtasn1 leading to potential remote dosEPSS 1.1%CVE-2024-21909HIGHDenial of service in CBOR libraryEPSS 1.1%CVE-2023-26485MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2023-24824MEDIUMQuadratic complexity may lead to a denial of service in cmark-gfmEPSS 1.0%CVE-2026-1285HIGHPotential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsEPSS 1.0%