Skip to content
OpenAdvisories

Weakness (CWE)

CWE-407: Inefficient Algorithmic Complexity

Class Incomplete

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Source: MITRE CWE-407

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-77680 Public exploit

    Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

    An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7…

    Red Hat Red Hat Enterprise Linux 10 libsoup3 libsoup3 Linux Debian Ubuntu
  • Low 3.3
    CVE-2026-6042 Public exploit

    musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity

    A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be in…

    musl libc musl musl Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-33033 Public exploit

    Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

    An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade performance by submitting multipart uploads with `Content-Transfer-Encoding: base64` including excessive whitespace. Ea…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2025-64458 Public exploit

    Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

    An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django…

    djangoproject Django django py3-django Alpine PyPI
  • High 7.5
    CVE-2025-62727 Public exploit

    Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse

    Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileResponse Range parsing/merg…

    Kludex starlette starlette starlette Debian Ubuntu PyPI
  • High 8.0
    CVE-2023-46136 Public exploit

    Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

    Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8, if an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: a…

    pallets werkzeug werkzeug python-werkzeug Debian Alpine PyPI
  • Medium 5.2
    CVE-2020-27223 Public exploit EPSS 78%

    DOS vulnerability for Quoted Quality CSV headers

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven