Common Weakness Enumeration
CWE-407
Allowed-with-ReviewInefficient Algorithmic Complexity
Abstraction: Class · Status: Incomplete
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
262 vulnerabilities reference this CWE, most recent first.
GHSA-HC3C-6XQP-R265
Vulnerability from github – Published: 2025-03-21 09:30 – Updated: 2025-03-21 09:30
VLAI
Details
encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).
Severity
5.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-30348"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-21T07:15:37Z",
"severity": "MODERATE"
},
"details": "encodeText in QDom in Qt before 6.8.0 has a complex algorithm involving XML string copy and inline replacement of parts of a string (with relocation of later data).",
"id": "GHSA-hc3c-6xqp-r265",
"modified": "2025-03-21T09:30:34Z",
"published": "2025-03-21T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30348"
},
{
"type": "WEB",
"url": "https://codereview.qt-project.org/c/qt/qtbase/+/581442"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HF3R-VMRV-7W29
Vulnerability from github – Published: 2024-01-03 18:30 – Updated: 2024-01-03 22:28
VLAI
Summary
Duplicate Advisory: Denial of service in CBOR library
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6r92-cgxc-r5fg. This link is maintained to preserve external references.
Original Description
PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "PeterO.Cbor"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T21:06:15Z",
"nvd_published_at": "2024-01-03T16:15:09Z",
"severity": "HIGH"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6r92-cgxc-r5fg. This link is maintained to preserve external references.\n\n### Original Description\nPeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\n",
"id": "GHSA-hf3r-vmrv-7w29",
"modified": "2024-01-03T22:28:05Z",
"published": "2024-01-03T18:30:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21909"
},
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6r92-cgxc-r5fg"
},
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Duplicate Advisory: Denial of service in CBOR library",
"withdrawn": "2024-01-03T21:06:15Z"
}
GHSA-HFJ8-63C8-RMFW
Vulnerability from github – Published: 2024-01-19 21:30 – Updated: 2026-01-22 20:53
VLAI
Summary
Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.
Original Description
Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.upokecenter:cbor"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T14:36:37Z",
"nvd_published_at": "2024-01-19T21:15:10Z",
"severity": "HIGH"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-36p8-mvp6-cv38. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application\u0027s use of this library, this may be a remote attacker.",
"id": "GHSA-hfj8-63c8-rmfw",
"modified": "2026-01-22T20:53:05Z",
"published": "2024-01-19T21:30:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/peteroupc/CBOR-Java/security/advisories/GHSA-fj2w-wfgv-mwq6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23684"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-fj2w-wfgv-mwq6"
},
{
"type": "PACKAGE",
"url": "https://github.com/peteroupc/CBOR-Java"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-fj2w-wfgv-mwq6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: Inefficient Algorithmic Complexity in com.upokecenter:cbor",
"withdrawn": "2026-01-22T20:53:05Z"
}
GHSA-HFQX-732W-XRRW
Vulnerability from github – Published: 2025-12-03 21:31 – Updated: 2026-01-26 15:30
VLAI
Details
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-12084"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-03T19:15:55Z",
"severity": "MODERATE"
},
"details": "When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.",
"id": "GHSA-hfqx-732w-xrrw",
"modified": "2026-01-26T15:30:31Z",
"published": "2025-12-03T21:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12084"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/142145"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/142146"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/027f21e417b26eed4505ac2db101a4352b7c51a0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/08d8e18ad81cd45bc4a27d6da478b51ea49486e4"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/27648a1818749ef44c420afe6173af6868715437"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/41f468786762348960486c166833a218a0a436af"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/57937a8e5e293f0dcba5115f7b7a11b1e0c9a273"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/8d2d7bb2e754f8649a68ce4116271a4932f76907"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/9c9dda6625a2a90d2a06c657eee021d6be19842d"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/a46c10ec9d4050ab67b8a932e0859a2ea60c3cb8"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/a696ba8b4d42fd632afc9bc88ad830a2e4cceed8"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c97e87593063d84a2bd9fe7068b30eb44de23dc0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ddcd2acd85d891a53e281c773b3093f9db953964"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/e91c11449cad34bac3ea55ee09ca557691d92b53"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HQQC-JR88-P6X2
Vulnerability from github – Published: 2025-03-31 21:47 – Updated: 2025-03-31 21:47
VLAI
Summary
Netty QUIC hash collision DoS attack
Details
An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).
See https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.netty.incubator:netty-incubator-codec-quic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.71.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-29908"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-31T21:47:20Z",
"nvd_published_at": "2025-03-31T19:15:40Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the codec. A hash collision vulnerability (in the hash map used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).\n\nSee https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory",
"id": "GHSA-hqqc-jr88-p6x2",
"modified": "2025-03-31T21:47:21Z",
"published": "2025-03-31T21:47:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty-incubator-codec-quic/security/advisories/GHSA-hqqc-jr88-p6x2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29908"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty-incubator-codec-quic/commit/e059bd9b78723f8b035e0c547e42ce263f03461c"
},
{
"type": "WEB",
"url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty-incubator-codec-quic"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Netty QUIC hash collision DoS attack"
}
GHSA-J3QR-8F3V-FGJJ
Vulnerability from github – Published: 2025-02-10 18:30 – Updated: 2026-06-30 03:35
VLAI
Details
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-12133"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-10T16:15:37Z",
"severity": "MODERATE"
},
"details": "A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.",
"id": "GHSA-j3qr-8f3v-fgjj",
"modified": "2026-06-30T03:35:19Z",
"published": "2025-02-10T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250523-0003"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00025.html"
},
{
"type": "WEB",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
},
{
"type": "WEB",
"url": "https://gitlab.com/gnutls/libtasn1/-/blob/master/doc/security/CVE-2024-12133.md"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-202008.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344611"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-12133"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:33125"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30850"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30849"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:8021"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:7077"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:4049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17347"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/02/06/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-JFM3-95JQ-Q3RF
Vulnerability from github – Published: 2026-08-06 20:40 – Updated: 2026-08-06 20:42
VLAI
Summary
league/commonmark: Denial of service via duplicate footnote definitions
Details
Impact
The Footnote extension records one backref per footnote reference and then appends the entire backref list for every footnote definition block in the document, without ever de-duplicating or removing repeated definitions of the same label (GatherFootnotesListener, populated by NumberFootnotesListener). A document that references a single label N times and also supplies N duplicate [^a]: definitions of that label therefore produces N × N FootnoteBackref nodes, so output size, parse time, and peak memory are all O(N²).
Reaching the vulnerable path requires FootnoteExtension to be registered on the Environment. This is opt-in, but is a commonly enabled GFM-style feature; no other non-default configuration is required. An unauthenticated attacker can expand a ~10 KB request into a ~62 MB HTML response, ~3 s of CPU, and ~440 MB of peak memory — enough to OOM-kill a default 128 MB PHP worker and deny service. Availability impact only; no confidentiality or integrity effect. The Footnote extension was introduced in 1.5.0 (May 2020) with this backref logic present from the first commit, so all releases from 1.5.0 onward (including every 2.x through 2.8.x) are affected.
Workarounds
There is no library-level option to cap the number of footnotes, references, or definitions, so no configuration switch prevents the amplification. Integrators who cannot upgrade should:
- Disable the Footnote extension for untrusted input, or
- Enforce a strict input-size limit before conversion — but note this is a weak control here, since the ~10 KB payload that already triggers the 62 MB / ~440 MB blowup is well within typical request-body limits, so any cap must be aggressively small to help.
Upgrading to the patched release is the recommended remediation.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "league/commonmark"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "2.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T20:40:53Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nThe Footnote extension records one backref per footnote *reference* and then appends the **entire** backref list for **every** footnote *definition* block in the document, without ever de-duplicating or removing repeated definitions of the same label (`GatherFootnotesListener`, populated by `NumberFootnotesListener`). A document that references a single label N times and also supplies N duplicate `[^a]:` definitions of that label therefore produces **N \u00d7 N** `FootnoteBackref` nodes, so output size, parse time, and peak memory are all **O(N\u00b2)**.\n\nReaching the vulnerable path requires `FootnoteExtension` to be registered on the `Environment`. This is opt-in, but is a commonly enabled GFM-style feature; no other non-default configuration is required. An unauthenticated attacker can expand a **~10 KB** request into a **~62 MB** HTML response, **~3 s** of CPU, and **~440 MB** of peak memory \u2014 enough to OOM-kill a default 128 MB PHP worker and deny service. Availability impact only; no confidentiality or integrity effect. **The Footnote extension was introduced in 1.5.0 (May 2020) with this backref logic present from the first commit, so all releases from 1.5.0 onward (including every 2.x through 2.8.x) are affected.**\n\n### Workarounds\n\nThere is no library-level option to cap the number of footnotes, references, or definitions, so no configuration switch prevents the amplification. Integrators who cannot upgrade should:\n\n- **Disable the Footnote extension** for untrusted input, or\n- **Enforce a strict input-size limit before conversion** \u2014 but note this is a weak control here, since the ~10 KB payload that already triggers the 62 MB / ~440 MB blowup is well within typical request-body limits, so any cap must be aggressively small to help.\n\nUpgrading to the patched release is the recommended remediation.",
"id": "GHSA-jfm3-95jq-q3rf",
"modified": "2026-08-06T20:42:11Z",
"published": "2026-08-06T20:40:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/commit/66028124a17ba193da7b11cc3dfda92df21bfbf4"
},
{
"type": "PACKAGE",
"url": "https://github.com/thephpleague/commonmark"
},
{
"type": "WEB",
"url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "league/commonmark: Denial of service via duplicate footnote definitions"
}
GHSA-JG6J-874M-WGJJ
Vulnerability from github – Published: 2026-06-03 18:33 – Updated: 2026-08-11 03:31
VLAI
Details
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-3276"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-03T16:16:29Z",
"severity": "MODERATE"
},
"details": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.",
"id": "GHSA-jg6j-874m-wgjj",
"modified": "2026-08-11T03:31:50Z",
"published": "2026-06-03T18:33:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3276"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/149079"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/149080"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/03/15"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JRM6-H9CQ-8GQW
Vulnerability from github – Published: 2023-06-30 22:17 – Updated: 2023-06-30 22:17
VLAI
Summary
PyPDF2 quadratic runtime with malformed PDF missing xref marker
Details
Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.
Patches
https://github.com/py-pdf/pypdf/pull/808
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
Severity
6.2 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.27.8"
},
"package": {
"ecosystem": "PyPI",
"name": "PyPDF2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-36810"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-30T22:17:52Z",
"nvd_published_at": "2023-06-30T19:15:09Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.\nThis quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.\n\n### Patches\nhttps://github.com/py-pdf/pypdf/pull/808\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)\n* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)",
"id": "GHSA-jrm6-h9cq-8gqw",
"modified": "2023-06-30T22:17:52Z",
"published": "2023-06-30T22:17:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/py-pdf/pypdf/security/advisories/GHSA-jrm6-h9cq-8gqw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36810"
},
{
"type": "WEB",
"url": "https://github.com/py-pdf/pypdf/issues/582"
},
{
"type": "WEB",
"url": "https://github.com/py-pdf/pypdf/pull/808"
},
{
"type": "WEB",
"url": "https://github.com/py-pdf/pypdf/commit/c6c56f550bb384e05f0139c796ba1308837d6373"
},
{
"type": "PACKAGE",
"url": "https://github.com/py-pdf/pypdf"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00019.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "PyPDF2 quadratic runtime with malformed PDF missing xref marker"
}
GHSA-M3RP-25VQ-JFCV
Vulnerability from github – Published: 2026-08-18 15:31 – Updated: 2026-08-18 15:31
VLAI
Details
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-66046"
],
"database_specific": {
"cwe_ids": [
"CWE-407"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T15:16:57Z",
"severity": "HIGH"
},
"details": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.",
"id": "GHSA-m3rp-25vq-jfcv",
"modified": "2026-08-18T15:31:47Z",
"published": "2026-08-18T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/pull/1321"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.