CWE-407 · Inefficient Algorithmic Complexity (page 3)
Page 3 of 3 — CVEs classified under CWE-407, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64458 | High | 7.5 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `djan… |
CVE-2025-58187 | High | 7.5 | 2025-10-29 | Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate… |
CVE-2025-62727 | High | 7.5 | 2025-10-28 | Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP… |
CVE-2025-55304 | Medium | 5.5 | 2025-08-29 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Ex… |
CVE-2025-27209 | High | 7.5 | 2025-07-18 | The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability… |
CVE-2023-30421 | Low | 2.9 | 2025-04-19 | mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e913013935755114. |
CVE-2025-29908 | Medium | 5.3 | 2025-03-31 | Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map use… |
CVE-2025-30348 | Medium | 5.8 | 2025-03-21 | encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later d… |
CVE-2025-24947 | Medium | 5.3 | 2025-02-20 | A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a co… |
CVE-2025-24946 | Medium | 5.3 | 2025-02-20 | The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on t… |
CVE-2025-23020 | Medium | 5.3 | 2025-02-20 | An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a… |
CVE-2024-12243 | Medium | 5.3 | 2025-02-10 | A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certi… |
CVE-2024-12133 | Medium | 5.3 | 2025-02-10 | A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much l… |
CVE-2024-9631 | High | 7.5 | 2025-02-05 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 p… |
CVE-2024-6324 | Medium | 4.3 | 2025-01-09 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 p… |
CVE-2024-8233 | High | 7.5 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause… |
CVE-2024-8237 | Medium | 6.5 | 2024-11-26 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior… |
CVE-2024-8177 | Medium | 5.3 | 2024-11-26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior… |
CVE-2024-11828 | Medium | 4.3 | 2024-11-26 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1… |
CVE-2020-3548 | Medium | 5.3 | 2024-11-18 | A vulnerability in the Transport Layer Security (TLS) protocol implementation of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) coul… |
CVE-2024-43485 | High | 7.5 | 2024-10-08 | .NET and Visual Studio Denial of Service Vulnerability |
CVE-2024-43484 | High | 7.5 | 2024-10-08 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
CVE-2024-43483 | High | 7.5 | 2024-10-08 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
CVE-2024-39702 | Medium | 5.9 | 2024-07-23 | In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) att… |
CVE-2024-29916 | Medium | 5.6 | 2024-03-21 | The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the att… |
CVE-2023-4408 | High | 7.5 | 2024-02-13 | The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, b… |
CVE-2024-23684 | High | 7.5 | 2024-01-19 | Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versi… |
CVE-2024-21909 | High | 7.5 | 2024-01-03 | PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by prov… |
CVE-2023-46136 | High | 8.0 | 2023-10-25 | Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a… |
CVE-2023-38285 | High | 7.5 | 2023-07-26 | Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. |
CVE-2023-36810 | Medium | 6.2 | 2023-06-30 | pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability ca… |
CVE-2023-2473 | Medium | 4.3 | 2023-05-02 | A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserCo… |
CVE-2023-26485 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2023-24824 | Medium | 5.3 | 2023-03-31 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to u… |
CVE-2022-36021 | Medium | 5.5 | 2023-03-01 | Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pat… |
CVE-2023-22486 | Low | 3.5 | 2023-01-26 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 contain a polynomial time com… |
CVE-2023-22484 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to a polynomial ti… |
CVE-2023-22483 | Low | 3.5 | 2023-01-23 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject to several polynom… |
CVE-2022-45061 | High | 7.5 | 2022-11-09 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decod… |
CVE-2022-40188 | High | 7.5 | 2022-09-23 | Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an autho… |
CVE-2022-39209 | High | 7.5 | 2022-09-15 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexit… |
CVE-2022-22153 | High | 7.5 | 2022-01-19 | An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow processing daemon (flowd… |
CVE-2021-41168 | Medium | 6.5 | 2021-10-21 | Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affected versions snudown was found to be vu… |
CVE-2021-33582 | High | 7.5 | 2021-09-01 | Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table inter… |
CVE-2020-27223 | Medium | 5.2 | 2021-02-26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a lar… |
CVE-2019-19331 | High | 7.5 | 2019-12-16 | knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be proces… |
CVE-2018-12558 | High | 7.5 | 2018-06-20 | The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial o… |
CVE-2017-11343 | High | 7.5 | 2017-07-17 | Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An at… |
CVE-2016-10396 | High | 7.5 | 2017-07-06 | The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implement… |