CWE-407 Inefficient Algorithmic Complexity
classAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (275)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-27223US | medium5.3 | Exploit | ||
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality… | ||||
| CVE-2022-36021US | medium5.5 | — | ||
Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a den… | ||||
| CVE-2015-8391US | critical9.8 | — | ||
The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possi… | ||||
| CVE-2023-46136US | high7.5 | Exploit | ||
Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with… | ||||
| CVE-2026-77680US | medium5.3 | Exploit | ||
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix.
CVE-2025-32907 addressed memory amplification when a cl… | ||||
| CVE-2022-45061US | high7.5 | — | ||
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a craft… | ||||
| CVE-2022-40188US | high7.5 | — | ||
Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must… | ||||
| CVE-2021-33582US | high7.5OT elevated | — | ||
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there… | ||||
| CVE-2019-19331US | high7.5 | — | ||
knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficientl… | ||||
| CVE-2018-12558US | high7.5 | — | ||
The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared s… | ||||
| CVE-2016-10396US | high7.5 | — | ||
The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remot… | ||||
| CVE-2026-117540US | high7.5 | — | ||
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthen… | ||||
| CVE-2026-116872US | high7.5 | — | ||
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause q… | ||||
| CVE-2026-115352US | high7.5 | — | ||
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unma… | ||||
| CVE-2026-115347US | high7.5 | — | ||
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced squa… | ||||
| CVE-2026-96640US | high7.5 | — | ||
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate… | ||||
| CVE-2026-19630US | high7.5 | — | ||
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously… | ||||
| CVE-2026-112894US | high7.5 | — | ||
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.… | ||||
| CVE-2026-112891US | high7.5 | — | ||
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portion… | ||||
| CVE-2026-96958US | high7.5 | — | ||
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan