CWE-407: Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Consequences

• Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)

Recent advisories

• GHSA-2qm8-x737-gmw5 — pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
• GHSA-mm57-4v3p-rchx — pyasn1 has quadratic-complexity denial of service in binary REAL decoding
• GHSA-9m75-vc3g-4x39 — pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
• GHSA-fm9c-5rcf-2q5p — pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
• GHSA-mgcc-cww5-fp2q — Go JOSE: DoS when parsing JWKs that contain RSA keys
• EEF-CVE-2026-65631 — erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
• EEF-CVE-2026-108529 — SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
• EEF-CVE-2026-113436 — Quadratic bignum parsing of Content-Length and Host port values in Bandit
• GHSA-jr96-gvgh-j3r4 — pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
• GHSA-g4qv-2jxx-769h — Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
• GHSA-mrfp-p49p-3hf2 — Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
• GHSA-6vvc-x485-93v7 — pypdf: Possible long runtimes/large memory usage when retrieving form fields
• GHSA-jg86-v3jv-hrpm — Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
• GHSA-fc9g-5qg7-mf45 — Pillow: Quadratic GIF comment copying during save
• GHSA-74r2-7ff9-mjj2 — Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

All advisories for CWE-407