Fallos del tipo CWE-407

115 resultados

Complexidade algorítmica ineficiente

É quando o código usa um algoritmo cuja complexidade computacional cresce desproporcionalmente com o tamanho da entrada, permitindo que um atacante consuma recursos (CPU, memória, tempo) enviando dados malformados ou massivos. O perigo: negação de serviço (DoS) ou travamento da aplicação sem necessidade de exploração de bugs clássicos.

Ejemplo

Uma API que processa lista de usuários com dois loops aninhados (O(n²)) em vez de usar hash ou índice. Um atacante envia 10 mil usuários e a operação que demoraria milissegundos passa a levar minutos, derrubando o servidor.

Cómo mitigar

Escolha algoritmos eficientes (use estruturas de dados apropriadas: hash, árvores balanceadas); implemente limites de entrada (validar tamanho máximo de listas, strings); monitore tempo de execução e aborte operações que excedem threshold; teste performance com dados grandes durante development.

CVE-2026-56669HIGHElysia: Inefficient Algorithmic Complexity and Interpretation ConflictEPSS 0.4%CVE-2026-67216HIGHcJSON cJSON_Compare Exponential Complexity Denial of ServiceEPSS 0.4%CVE-2026-31937HIGHSuricata dcerpc: quadratic complexity in dcerpc bufferingEPSS 0.4%CVE-2026-31933HIGHSuricata stream: quadratic complexity in stream inspectionEPSS 0.4%CVE-2026-33123MEDIUMpypdf has inefficient decoding of array-based streamsEPSS 0.3%CVE-2026-13149HIGHbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number oEPSS 0.3%CVE-2026-35599MEDIUMVikunja has an Algorithmic Complexity DoS in Repeating Task HandlerEPSS 0.3%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.3%CVE-2025-30348MEDIUMencodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with reEPSS 0.3%CVE-2026-59887HIGHlinkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textEPSS 0.3%CVE-2026-42923MEDIUMDegradation of service with unbounded NSEC3 hash calculationsEPSS 0.3%CVE-2026-57480HIGHParse Server: Denial of service via exponential-time processing of deeply nested query operatorsEPSS 0.3%CVE-2026-59885HIGHpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceEPSS 0.3%CVE-2026-58059HIGHQuadratic-time escaping when stringifying X.500 distinguished namesEPSS 0.3%CVE-2026-44378MEDIUMBotan: Quadratic complexity decoding BER indefinite length encodingsEPSS 0.3%CVE-2025-14822LOWDoS from quadratic complexity in model.ParseHashtagsEPSS 0.3%CVE-2024-29916MEDIUMThe dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged kEPSS 0.3%CVE-2026-6879LOWQuadratic Behavior in xml.etree.ElementPath Index PredicatesEPSS 0.3%CVE-2026-45822MEDIUMdecode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and callEPSS 0.3%CVE-2025-67841HIGHNordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.EPSS 0.3%