CWE-407 · Denial of Service
Inefficient Algorithmic Complexity
293CVEs
SortMost likely exploited
293 CVEs with CWE-407 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-27223In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “qualit…The Eclipse Foundation · Eclipse Jetty · CVSS 5.2 · 2021-02-26 | 5.2 | 78% | 2021-02-26 |
| CVE-2022-36021Redis string pattern matching can be abused to achieve Denial of Serviceredis · redis · CVSS 5.5 · 2023-03-01 | 5.5 | 60% | 2023-03-01 |
| CVE-2022-45061An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a craf…Python · Python · CVSS 7.5 · 2022-11-09 | 7.5 | 3.3% | 2022-11-09 |
| CVE-2021-33582Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because ther…Cyrus · Imap · 2021-09-01 | – | 3.1% | 2021-09-01 |
| CVE-2024-43485.NET and Visual Studio Denial of Service VulnerabilityMicrosoft · .NET 6.0 · CVSS 7.5 · 2024-10-08 | 7.5 | 3.1% | 2024-10-08 |
| CVE-2024-43484.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityMicrosoft · .NET 6.0 · CVSS 7.5 · 2024-10-08 | 7.5 | 3.0% | 2024-10-08 |
| CVE-2016-10396The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragments. The implementation permits a remo…Ipsec-Tools · Ipsec-Tools · 2017-07-06 | – | 2.9% | 2017-07-06 |
| CVE-2024-43483.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityMicrosoft · .NET 6.0 · CVSS 7.5 · 2024-10-08 | 7.5 | 2.9% | 2024-10-08 |
| CVE-2018-12558The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared…Email::address Module Project · Email::address · 2018-06-20 | – | 2.6% | 2018-06-20 |
| CVE-2025-64460Potential denial-of-service vulnerability in XML serializer text extractiondjangoproject · Django · CVSS 7.5 · 2025-12-02 | 7.5 | 2.2% | 2025-12-02 |
| CVE-2019-19331knot-resolver before version 4.3.0 is vulnerable to denial of service through high CPU utilization. DNS replies with very many resource records might be processed very inefficient…CZ.NIC · knot-resolver · CVSS 7.5 · 2019-12-16 | 7.5 | 2.1% | 2019-12-16 |
| CVE-2022-40188Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an authoritative server must…Nic · Knot Resolver · CVSS 7.5 · 2022-09-23 | 7.5 | 1.9% | 2022-09-23 |
| CVE-2025-64458Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windowsdjangoproject · Django · CVSS 7.5 · 2025-11-05 | 7.5 | 1.9% | 2025-11-05 |
| CVE-2023-4408Parsing large DNS messages may cause excessive CPU loadISC · BIND 9 · CVSS 7.5 · 2024-02-13 | 7.5 | 1.4% | 2024-02-13 |
| CVE-2026-118747.NET Denial of Service VulnerabilityMicrosoft · System.Formats.Cbor · CVSS 7.5 · 2026-11-10 | 7.5 | 1.3% | 2026-11-10 |
| CVE-2026-118153Microsoft Exchange Server Denial of Service VulnerabilityMicrosoft · Microsoft Exchange Server Subscription Edition RTM · CVSS 7.5 · 2026-11-10 | 7.5 | 1.3% | 2026-11-10 |
| CVE-2024-12243Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dosSiemens · gnutls · CVSS 5.3 · 2025-02-10 | 5.3 | 1.3% | 2025-02-10 |
| CVE-2023-46136Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningpallets · werkzeug · CVSS 8 · 2023-10-24 | 8.0 | 1.3% | 2023-10-24 |
| CVE-2025-27209The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who c…nodejs · node · CVSS 7.5 · 2025-07-18 | 7.5 | 1.3% | 2025-07-18 |
| CVE-2026-69651.NET Denial of Service VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 7.5 · 2026-10-13 | 7.5 | 1.3% | 2026-10-13 |
| CVE-2026-109478ASP.NET Core Denial of Service VulnerabilityMicrosoft · .NET 8.0 installed on Linux · CVSS 7.5 · 2026-11-10 | 7.5 | 1.2% | 2026-11-10 |
| CVE-2026-96958.NET Denial of Service VulnerabilityMicrosoft · Microsoft .NET Framework 3.5 · CVSS 7.5 · 2026-10-13 | 7.5 | 1.2% | 2026-10-13 |
| CVE-2026-112966Windows Security Account Manager Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-11-10 | 7.5 | 1.2% | 2026-11-10 |
| CVE-2026-120796.NET Denial of Service VulnerabilityMicrosoft · .NET 11.0 installed on Linux · CVSS 5.3 · 2026-11-10 | 5.3 | 1.2% | 2026-11-10 |
| CVE-2023-22486cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of servicegithub · cmark-gfm · CVSS 3.5 · 2023-01-24 | 3.5 | 1.1% | 2023-01-24 |
| CVE-2026-1285Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsdjangoproject · Django · CVSS 7.5 · 2026-02-03 | 7.5 | 1.1% | 2026-02-03 |
| CVE-2025-14550Potential denial-of-service vulnerability via repeated headers when using ASGIdjangoproject · Django · CVSS 7.5 · 2026-02-03 | 7.5 | 1.1% | 2026-02-03 |
| CVE-2024-12133Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dosSiemens · libtasn1 · CVSS 5.3 · 2025-02-10 | 5.3 | 1.1% | 2025-02-10 |
| CVE-2026-118749ASP.NET Core Denial of Service VulnerabilityMicrosoft · .NET 11.0 installed on Linux · CVSS 7.5 · 2026-11-10 | 7.5 | 1.1% | 2026-11-10 |
| CVE-2024-21909Denial of service in CBOR libraryPeteroupc · PeterO.Cbor · CVSS 7.5 · 2024-01-03 | 7.5 | 1.1% | 2024-01-03 |
| CVE-2023-24824Quadratic complexity may lead to a denial of service in cmark-gfmgithub · cmark-gfm · CVSS 5.3 · 2023-03-31 | 5.3 | 1.0% | 2023-03-31 |
| CVE-2026-55968Apache Thrift: Node.js quadratic-time DoS in server receive transportsApache Software Foundation · Apache Thrift · CVSS 8.7 · 2026-07-27 | 8.7 | 1.0% | 2026-07-27 |
| CVE-2023-26485Quadratic complexity may lead to a denial of service in cmark-gfmgithub · cmark-gfm · CVSS 5.3 · 2023-03-31 | 5.3 | 1.0% | 2023-03-31 |
| CVE-2026-84008.NET Denial of Service VulnerabilityMicrosoft · Microsoft .NET Framework 3.5 · CVSS 7.5 · 2026-10-13 | 7.5 | 1.0% | 2026-10-13 |
| CVE-2023-22484Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of servicegithub · cmark-gfm · CVSS 3.5 · 2023-01-23 | 3.5 | 1.0% | 2023-01-23 |
| CVE-2022-22153SRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet dropsJuniper Networks · Junos OS · CVSS 7.5 · 2022-01-19 | 7.5 | 1.0% | 2022-01-19 |
| CVE-2017-11343Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide c…Call-Cc · Chicken · 2017-07-16 | – | 0.9% | 2017-07-16 |
| CVE-2023-2473Dreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexityIteachyou · Dreamer CMS · CVSS 4.3 · 2023-05-02 | 4.3 | 0.9% | 2023-05-02 |
| CVE-2024-23684upokecenter CBOR Denial of ServicePeteroupc · com.upokecenter:cbor · CVSS 7.5 · 2024-01-19 | 7.5 | 0.9% | 2024-01-19 |
| CVE-2026-33033Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploaddjangoproject · Django · CVSS 6.5 · 2026-04-07 | 6.5 | 0.9% | 2026-04-07 |
| CVE-2026-70196ASP.NET Core Denial of Service VulnerabilityMicrosoft · ASP.NET Core 10.0 · CVSS 5.9 · 2026-10-13 | 5.9 | 0.9% | 2026-10-13 |
| CVE-2023-38285Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.Owasp · Modsecurity · 2023-07-26 | – | 0.9% | 2023-07-26 |
| CVE-2026-54892Plug: quadratic-time decoding of nested query/body parameters enables denial of serviceelixir-plug · plug · CVSS 8.7 · 2026-06-23 | 8.7 | 0.9% | 2026-06-23 |
| CVE-2026-66046Expat Denial of Service via storeAtts() Quadratic Complexitylibexpat project · libexpat · CVSS 7.5 · 2026-08-18 | 7.5 | 0.9% | 2026-08-18 |
| CVE-2025-12084Quadratic complexity in node ID cache clearingPython Software Foundation · CPython · CVSS 6.3 · 2025-12-03 | 6.3 | 0.9% | 2025-12-03 |
| CVE-2026-40476graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validationwebonyx · graphql-php · CVSS 6.9 · 2026-04-17 | 6.9 | 0.8% | 2026-04-17 |
| CVE-2020-3548Cisco Email Security Appliance Denial Of Service VulnerabilityCisco · Cisco Secure Email · CVSS 5.3 · 2024-11-18 | 5.3 | 0.8% | 2024-11-18 |
| CVE-2026-75507GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rulegraphql-python · graphql-core · CVSS 7.5 · 2026-10-22 | 7.5 | 0.8% | 2026-10-22 |
| CVE-2026-68750Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of servicerrrene · html_sanitize_ex · CVSS 8.2 · 2026-08-06 | 8.2 | 0.8% | 2026-08-06 |
| CVE-2025-62727Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponseKludex · starlette · CVSS 7.5 · 2025-10-28 | 7.5 | 0.8% | 2025-10-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.