CWE-407 · 187 records

Inefficient Algorithmic Complexity

CVEs in this class

191 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
44Plan	CVE-2020-27223Proof of concept	In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accepteclipse · jetty · CWE-407 Pre-auth Denial of service	Medium5.3	—	78.0%	Feb 26, 2021
40Plan	CVE-2022-36021No exploit	Redis string pattern matching can be abused to achieve Denial of Serviceredis · redis · CWE-407 Denial of service	Medium5.5	—	59.8%	Mar 1, 2023
34Monitor	CVE-2026-55968No exploit	Apache Thrift: Node.js quadratic-time DoS in server receive transportsapache · thrift · CWE-407 Pre-auth	High8.7	—	1.0%	Jul 27, 2026
34Monitor	CVE-2026-54892No exploit	Plug: quadratic-time decoding of nested query/body parameters enables denial of serviceelixir-plug · plug · CWE-407 Pre-auth	High8.7	—	0.9%	Jun 23, 2026
34Monitor	CVE-2026-43967No exploit	Quadratic fragment-name uniqueness check causes denial of service in absintheabsinthe-graphql · absinthe · CWE-407 Pre-auth	High8.7	—	0.8%	May 8, 2026
34Monitor	CVE-2026-59094No exploit	Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Storepathwaycom · pathway · CWE-407 Pre-auth	High8.7	—	0.8%	Jul 2, 2026
34Monitor	CVE-2026-66046No exploit	Expat Denial of Service via storeAtts() Quadratic Complexitylibexpat project · libexpat · CWE-407 Pre-auth	High8.7	—	0.7%	Aug 18, 2026
34Monitor	CVE-2026-75005No exploit	Apache APISIX: Unauthenticated CPU-exhaustion DoSapache · apisix · CWE-407 Pre-auth	High8.7	—	0.7%	Aug 27, 2026
34Monitor	CVE-2026-90776No exploit	Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsingnodemailer · nodemailer · CWE-407 Pre-auth	High8.7	—	0.7%	Sep 13, 2026
34Monitor	CVE-2026-87822No exploit	t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytestdunning · t-digest · CWE-407 Pre-auth Deserialization	High8.7	—	0.7%	Sep 9, 2026
34Monitor	CVE-2026-59880No exploit	Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Setimmutable-js · immutable · CWE-407 Pre-auth	High8.7	—	0.7%	Jul 8, 2026
34Monitor	CVE-2026-65623No exploit	Quadratic CPU blow-up reassembling fragmented WebSocket messages in Banditmtrudel · bandit · CWE-407 Pre-auth	High8.7	—	0.6%	Jul 24, 2026
34Monitor	CVE-2026-85446No exploit	MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Servicemoos-ivp · moos-ivp · CWE-407 Pre-auth	High8.7	—	0.6%	Sep 3, 2026
34Monitor	CVE-2026-92987No exploit	roxmltree through 0.21.1 Denial of Service via Quadratic Parsingrazrfalcon · roxmltree · CWE-407 Pre-auth	High8.7	—	0.6%	Sep 17, 2026
34Monitor	CVE-2026-83613No exploit	xmldom: Quadratic-time attribute deduplicationxmldom · xmldom · CWE-407 Pre-auth	High8.7	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-57480No exploit	Parse Server: Denial of service via exponential-time processing of deeply nested query operatorsparse-community · parse-server · CWE-407 Pre-auth	High8.7	—	0.6%	Jul 8, 2026
34Monitor	CVE-2026-58226No exploit	Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpaxelixir-mint · hpax · CWE-407 Pre-auth	High8.7	—	0.5%	Jul 6, 2026
34Monitor	CVE-2026-70453No exploit	rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()rsyncproject · rsync · CWE-407 Pre-auth	High8.7	—	0.5%	Aug 13, 2026
34Monitor	CVE-2026-81722No exploit	nltk PorterStemmer before 3.10.3 Quadratic-time DoSnltk · nltk · CWE-407 Pre-auth	High8.7	—	0.5%	Aug 27, 2026
34Monitor	CVE-2026-86429No exploit	commonmark before 2.9.1 Denial of Service via SmartPunct and Attributesthephpleague · commonmark · CWE-407 Pre-auth	High8.7	—	0.5%	Sep 7, 2026
34Monitor	CVE-2026-49250No exploit	Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsedmundhung · conform · CWE-407 Pre-auth	High8.7	—	0.5%	Sep 14, 2026
34Monitor	CVE-2026-86433No exploit	commonmark 1.5.0 before 2.8.4 Denial of Service via Attributesthephpleague · commonmark · CWE-407 Pre-auth	High8.7	—	0.5%	Sep 7, 2026
34Monitor	CVE-2026-86434No exploit	commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collisionthephpleague · commonmark · CWE-407 Pre-auth	High8.7	—	0.5%	Sep 7, 2026
34Monitor	CVE-2026-58059No exploit	Quadratic-time escaping when stringifying X.500 distinguished namesbouncycastle · bc-java · CWE-407 Pre-auth	High8.7	—	0.5%	Aug 2, 2026
34Monitor	CVE-2026-86430No exploit	league/commonmark before 2.9.1 Denial of Service via parsingthephpleague · commonmark · CWE-407 Pre-auth	High8.7	—	0.5%	Sep 7, 2026

CVE-2020-27223
44Plan
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept
MediumCVSS 5.3Proof of conceptEPSS 78%
- Pre-auth
- Denial of service
eclipse · jettyFeb 26, 2021
CVE-2022-36021
40Plan
Redis string pattern matching can be abused to achieve Denial of Service
MediumCVSS 5.5No exploitEPSS 60%
- Denial of service
redis · redisMar 1, 2023
CVE-2026-55968
34Monitor
Apache Thrift: Node.js quadratic-time DoS in server receive transports
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
apache · thriftJul 27, 2026
CVE-2026-54892
34Monitor
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
elixir-plug · plugJun 23, 2026
CVE-2026-43967
34Monitor
Quadratic fragment-name uniqueness check causes denial of service in absinthe
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
absinthe-graphql · absintheMay 8, 2026
CVE-2026-59094
34Monitor
Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Document Store
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
pathwaycom · pathwayJul 2, 2026
CVE-2026-66046
34Monitor
Expat Denial of Service via storeAtts() Quadratic Complexity
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
libexpat project · libexpatAug 18, 2026
CVE-2026-75005
34Monitor
Apache APISIX: Unauthenticated CPU-exhaustion DoS
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
apache · apisixAug 27, 2026
CVE-2026-90776
34Monitor
Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
nodemailer · nodemailerSep 13, 2026
CVE-2026-87822
34Monitor
t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
- Deserialization
tdunning · t-digestSep 9, 2026
CVE-2026-59880
34Monitor
Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
immutable-js · immutableJul 8, 2026
CVE-2026-65623
34Monitor
Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
mtrudel · banditJul 24, 2026
CVE-2026-85446
34Monitor
MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
moos-ivp · moos-ivpSep 3, 2026
CVE-2026-92987
34Monitor
roxmltree through 0.21.1 Denial of Service via Quadratic Parsing
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
razrfalcon · roxmltreeSep 17, 2026
CVE-2026-83613
34Monitor
xmldom: Quadratic-time attribute deduplication
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
xmldom · xmldomSep 1, 2026
CVE-2026-57480
34Monitor
Parse Server: Denial of service via exponential-time processing of deeply nested query operators
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
parse-community · parse-serverJul 8, 2026
CVE-2026-58226
34Monitor
Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
elixir-mint · hpaxJul 6, 2026
CVE-2026-70453
34Monitor
rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
rsyncproject · rsyncAug 13, 2026
CVE-2026-81722
34Monitor
nltk PorterStemmer before 3.10.3 Quadratic-time DoS
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
nltk · nltkAug 27, 2026
CVE-2026-86429
34Monitor
commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
thephpleague · commonmarkSep 7, 2026
CVE-2026-49250
34Monitor
Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
edmundhung · conformSep 14, 2026
CVE-2026-86433
34Monitor
commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
thephpleague · commonmarkSep 7, 2026
CVE-2026-86434
34Monitor
commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
thephpleague · commonmarkSep 7, 2026
CVE-2026-58059
34Monitor
Quadratic-time escaping when stringifying X.500 distinguished names
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
bouncycastle · bc-javaAug 2, 2026
CVE-2026-86430
34Monitor
league/commonmark before 2.9.1 Denial of Service via parsing
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
thephpleague · commonmarkSep 7, 2026

All vulnerability classes