Common Weakness Enumeration

CWE-407

Allowed-with-Review

Inefficient Algorithmic Complexity

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

432 vulnerabilities reference this CWE, most recent first.

CVE-2026-112894 (GCVE-0-2026-112894)

Vulnerability from cvelistv5 – Published: 2026-10-19 21:55 – Updated: 2026-10-19 21:55
VLAI
Title
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Summary
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
python-pillow Pillow Affected: >= 5.1.0, < 13.0.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.1.0, \u003c 13.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T21:55:19.424Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jg86-v3jv-hrpm",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-112894",
    "datePublished": "2026-10-19T21:55:19.424Z",
    "dateReserved": "2026-10-19T20:16:09.856Z",
    "dateUpdated": "2026-10-19T21:55:19.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112891 (GCVE-0-2026-112891)

Vulnerability from cvelistv5 – Published: 2026-10-19 21:33 – Updated: 2026-10-19 21:33
VLAI
Title
Pillow: Quadratic GIF comment copying during save
Summary
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
python-pillow Pillow Affected: >= 9.2.0, < 13.0.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.2.0, \u003c 13.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attacker can supply an image with a large GIF comment to an application that saves it as GIF. This can consume excessive CPU and delay or deny service. This issue is fixed in version 13.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T21:33:32.180Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fc9g-5qg7-mf45",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow: Quadratic GIF comment copying during save"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-112891",
    "datePublished": "2026-10-19T21:33:32.180Z",
    "dateReserved": "2026-10-19T20:16:09.856Z",
    "dateUpdated": "2026-10-19T21:33:32.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112401 (GCVE-0-2026-112401)

Vulnerability from cvelistv5 – Published: 2026-10-19 21:15 – Updated: 2026-10-19 21:15
VLAI
Title
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
Summary
Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open(). An attacker can submit a small-dimension GIF containing many comment extensions to any application that opens the file. This can consume excessive CPU and deny service before the application can inspect the image. This issue is fixed in version 13.0.0.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
python-pillow Pillow Affected: >= 5.4.0, < 13.0.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Pillow",
          "vendor": "python-pillow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.4.0, \u003c 13.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open(). An attacker can submit a small-dimension GIF containing many comment extensions to any application that opens the file. This can consume excessive CPU and deny service before the application can inspect the image. This issue is fixed in version 13.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T21:15:21.484Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e"
        },
        {
          "name": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/python-pillow/Pillow/releases/tag/13.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-74r2-7ff9-mjj2",
        "discovery": "UNKNOWN"
      },
      "title": "Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-112401",
    "datePublished": "2026-10-19T21:15:21.484Z",
    "dateReserved": "2026-10-19T16:58:51.959Z",
    "dateUpdated": "2026-10-19T21:15:21.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111766 (GCVE-0-2026-111766)

Vulnerability from cvelistv5 – Published: 2026-10-19 19:47 – Updated: 2026-10-19 19:47
VLAI
Title
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
Summary
markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3.
Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • CWE-400 - Uncontrolled Resource Consumption
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
markdown-it markdown-it Affected: >= 15.0.0, < 15.0.3
Affected: < 14.3.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "markdown-it",
          "vendor": "markdown-it",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.0.0, \u003c 15.0.3"
            },
            {
              "status": "affected",
              "version": "\u003c 14.3.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML comments, processing instructions, declarations, or CDATA sections reaches src/rules_inline/html_inline.ts. Its HTML_TAG_RE match searches the remaining suffix for the appropriate terminator; when no terminator is present, parsing advances to the next opener and repeats the match over overlapping input, causing quadratic processing and denial of service through event-loop blocking or an unresponsive browser main thread. HTML blocks and the default HTML-disabled configuration are not affected by these payloads. This issue is fixed in versions 14.3.3 and 15.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T19:47:46.488Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-vfgh-jcmw-g37q"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/commit/928bc8c11ded60181c0e7fc5aa954eec582e8e79"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/commit/d99f48839d37af6fd8a2617516c43dab90755503"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.3"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-vfgh-jcmw-g37q",
        "discovery": "UNKNOWN"
      },
      "title": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111766",
    "datePublished": "2026-10-19T19:47:46.488Z",
    "dateReserved": "2026-10-16T17:52:09.082Z",
    "dateUpdated": "2026-10-19T19:47:46.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111759 (GCVE-0-2026-111759)

Vulnerability from cvelistv5 – Published: 2026-10-19 17:39 – Updated: 2026-10-19 18:22
VLAI
Title
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
Summary
markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:22 UTC
CWE
  • CWE-400 - Uncontrolled Resource Consumption
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
markdown-it markdown-it Affected: >= 15.0.0, < 15.0.2
Affected: < 14.3.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111759",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T18:22:34.328088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:22:54.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "markdown-it",
          "vendor": "markdown-it",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.0.0, \u003c 15.0.2"
            },
            {
              "status": "affected",
              "version": "\u003c 14.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause repeated scans of the entire opener stack. The same issue occurs with the quote types reversed. The default configuration (typographer: false) is not affected, but this option is enabled with high probability. This issue is fixed in versions 14.3.2 and 15.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T17:46:20.544Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/markdown-it/markdown-it/security/advisories/GHSA-r7fv-28h4-cvq7"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/commit/1b379c1b6d0522421bd1a51b77337c79af2c8670"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/commit/cf27366035edf9196667110c47d9d67b030a4152"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/commit/daf5a3c32303e5d9de01b12eeb725fb5990b8162"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/releases/tag/14.3.2"
        },
        {
          "name": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/markdown-it/markdown-it/releases/tag/15.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-r7fv-28h4-cvq7",
        "discovery": "UNKNOWN"
      },
      "title": "markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111759",
    "datePublished": "2026-10-19T17:39:10.264Z",
    "dateReserved": "2026-10-16T17:52:09.081Z",
    "dateUpdated": "2026-10-19T18:22:54.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110755 (GCVE-0-2026-110755)

Vulnerability from cvelistv5 – Published: 2026-10-16 22:07 – Updated: 2026-10-16 22:07
VLAI
Title
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
Summary
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.
Severity
No CVSS data available.
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 63/100 over 287 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 0 , < 1.65 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Text::CSV_XS"
          ],
          "packageName": "Text-CSV_XS",
          "packageURL": "pkg:cpan/Text-CSV_XS",
          "programFiles": [
            "CSV_XS.xs"
          ],
          "programRoutines": [
            {
              "name": "Text::CSV_XS::getline"
            }
          ],
          "repo": "https://github.com/cpan-authors/Text-CSV_XS",
          "versions": [
            {
              "lessThan": "1.65",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl\u0027s default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the whole unparsed remainder into a new buffer, which the next call parses and copies again, so the work grows with the square of the input size.\n\nA reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T22:07:10.643Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Text-CSV_XS 1.65 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-14T00:00:00.000Z",
          "value": "Fix committed to upstream repository."
        },
        {
          "lang": "en",
          "time": "2026-10-15T00:00:00.000Z",
          "value": "Version 1.65 released with fix."
        }
      ],
      "title": "Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-110755",
    "datePublished": "2026-10-16T22:07:10.643Z",
    "dateReserved": "2026-10-14T17:06:49.908Z",
    "dateUpdated": "2026-10-16T22:07:10.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110688 (GCVE-0-2026-110688)

Vulnerability from cvelistv5 – Published: 2026-10-19 18:12 – Updated: 2026-10-19 18:12
VLAI
Title
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
Summary
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
Severity
No CVSS data available.
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 63/100 over 287 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 4.51 , < 4.80 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Cpanel::JSON::XS"
          ],
          "packageName": "Cpanel-JSON-XS",
          "packageURL": "pkg:cpan/Cpanel-JSON-XS",
          "programFiles": [
            "XS.xs"
          ],
          "programRoutines": [
            {
              "name": "Cpanel::JSON::XS::incr_parse"
            }
          ],
          "repo": "https://github.com/rurban/Cpanel-JSON-XS",
          "versions": [
            {
              "lessThan": "4.80",
              "status": "affected",
              "version": "4.51",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.\n\nAt the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.\n\nA peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T18:12:25.276Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a297384e69c851b5d64e1c421d9b2dcc.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Cpanel-JSON-XS 4.80 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-14T00:00:00.000Z",
          "value": "Version 4.80 released with fix."
        }
      ],
      "title": "Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-110688",
    "datePublished": "2026-10-19T18:12:25.276Z",
    "dateReserved": "2026-10-14T13:27:36.845Z",
    "dateUpdated": "2026-10-19T18:12:25.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110270 (GCVE-0-2026-110270)

Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
VLAI
Title
OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
Summary
OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM.
Severity
6.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6503 records in the last 180 days details
References
Impacted products
Vendor Product Version
OW2 ASM Affected: 3.0 , < 9.11 (custom)
Create a notification for this product.
Date Public
2026-09-06 00:00
Credits
Eric Bruneton
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/org.ow2.asm/asm-commons",
          "product": "ASM",
          "repo": "https://gitlab.ow2.org/asm/asm",
          "vendor": "OW2",
          "versions": [
            {
              "lessThan": "9.11",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eric Bruneton"
        }
      ],
      "datePublic": "2026-09-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O(2^n) memory allocation, causing an OutOfMemoryError that crashes the JVM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:35.587Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/466"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/commit/f2b988af48719f85a274f2a05e37bc55c0cd22a1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm-commons/src/main/java/org/objectweb/asm/commons/JSRInlinerAdapter.java#L232"
        },
        {
          "name": "ASM 9.11 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://asm.ow2.io/versions.html"
        },
        {
          "name": "VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-exponential-memory-allocation-in-jsrinlineradapter"
        }
      ],
      "title": "OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110270",
    "datePublished": "2026-10-14T14:16:35.587Z",
    "dateReserved": "2026-10-13T18:55:57.281Z",
    "dateUpdated": "2026-10-14T14:16:35.587Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110261 (GCVE-0-2026-110261)

Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 18:01
VLAI
Title
OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
Summary
OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time.
Severity
6.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:01 UTC
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6503 records in the last 180 days details
References
Impacted products
Vendor Product Version
OW2 ASM Affected: 3.0 , < 9.11 (custom)
Create a notification for this product.
Date Public
2026-08-30 00:00
Credits
Eric Bruneton
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110261",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:01:38.790380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:01:52.492Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/org.ow2.asm/asm",
          "product": "ASM",
          "repo": "https://gitlab.ow2.org/asm/asm",
          "vendor": "OW2",
          "versions": [
            {
              "lessThan": "9.11",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eric Bruneton"
        }
      ],
      "datePublic": "2026-08-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. Attackers can craft methods that make the unbounded MethodWriter.computeAllFrames() fix point algorithm converge slowly, tying up transforming threads for unbounded time."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:33.613Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/463"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/commit/ab68bbd2521359b7c8cd3517c6331ced3d817ed0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1595"
        },
        {
          "name": "ASM 9.11 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://asm.ow2.io/versions.html"
        },
        {
          "name": "VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-excessive-cpu-consumption-via-classwriter-compute-frames"
        }
      ],
      "title": "OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110261",
    "datePublished": "2026-10-14T14:16:33.613Z",
    "dateReserved": "2026-10-13T18:33:55.549Z",
    "dateUpdated": "2026-10-14T18:01:52.492Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110260 (GCVE-0-2026-110260)

Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-20 00:59
VLAI
Title
OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
Summary
OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM.
Severity
6.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 00:59 UTC
CWE
  • CWE-407 - Inefficient Algorithmic Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6503 records in the last 180 days details
References
Impacted products
Vendor Product Version
OW2 ASM Affected: 3.0 , < 9.11 (custom)
Create a notification for this product.
Date Public
2026-08-23 00:00
Credits
Yu Bao, PayPal Cyber Security Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110260",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T00:59:30.315393Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T00:59:41.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo1.maven.org/maven2/",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/org.ow2.asm/asm",
          "product": "ASM",
          "repo": "https://gitlab.ow2.org/asm/asm",
          "vendor": "OW2",
          "versions": [
            {
              "lessThan": "9.11",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Bao, PayPal Cyber Security Team"
        }
      ],
      "datePublic": "2026-08-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge allocations and an OutOfMemoryError that crashes the JVM."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T14:16:32.915Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/merge_requests/461"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/commit/91057c98239d994aed5e46434e34e00d593c0daf"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.ow2.org/asm/asm/-/blob/ASM_9_10_1/asm/src/main/java/org/objectweb/asm/MethodWriter.java#L1662"
        },
        {
          "name": "ASM 9.11 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://asm.ow2.io/versions.html"
        },
        {
          "name": "VulnCheck Advisory: OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ow2-asm-3.0-before-9.11-quadratic-memory-allocation-via-exception-handlers"
        }
      ],
      "title": "OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110260",
    "datePublished": "2026-10-14T14:16:32.915Z",
    "dateReserved": "2026-10-13T18:33:55.549Z",
    "dateUpdated": "2026-10-20T00:59:41.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list