CVE-2026-113436 is an inefficient algorithmic complexity vulnerability in the header integer parser of the mtrudel bandit HTTP server. An unauthenticated remote attacker can exploit this by sending HTTP/1 or HTTP/2 requests with extremely large numeric values in the content-length or Host/:authority headers, causing excessive CPU consumption. The vulnerability arises because the parser builds numbers one digit at a time without limiting digit count, resulting in quadratic time complexity. This can lead to significant server resource exhaustion with relatively small network traffic. The issue affects bandit versions from 1.0.0-pre.7 up to but not including 1.14.0. The vulnerability has a high severity score of 8.7 and was fixed in version 1.14.0.
A vulnerability in pypdf prior to version 6.21.2 allows crafted PDF files with malformed cross-reference streams to cause excessive resource consumption. This occurs because an incomplete fix for repeated malformed cross-reference entries causes the library to reload the entire PDF stream multiple times during recovery attempts, leading to long runtimes. The issue is resolved in version 6.21.2.
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive (denial of service). Exploitation requires only that the application parse attacker-influenced XML; no authentication, privileges, or user interaction beyond ingesting the input are needed. There is no loss of confidentiality or integrity — no data disclosure, data modification, or code execution — and the impact is contained to the affected process.
CVE-2026-89314 is an inefficient algorithmic complexity vulnerability in Eclipse KeyPont - GOSE where the jwkFields.CheckConsistency function uses a nested loop to detect duplicate key_ops entries. This causes the validation cost to grow quadratically with the number of entries, potentially allowing a hostile JWKS document to consume excessive CPU resources during unmarshalling.
A vulnerability in graphql-core versions from 3.0.0 up to but not including 3.2.12 and from 3.3.0a1 up to but not including 3.3.0rc1 allows an unauthenticated remote attacker to cause excessive CPU consumption during the validation phase. This is due to the OverlappingFieldsCanBeMerged rule repeatedly comparing fields and recursively re-comparing flattened inline fragments without proper memoization, leading to quadratic or worse CPU usage. The issue is fixed in versions 3.2.12 and 3.3.0rc1.
A vulnerability in the python-pillow Pillow library versions 5.1.0 through 12.x allows an attacker to cause uncontrolled resource consumption. The PdfParser.linearize_page_tree() function treats a PDF /Pages graph as a tree without tracking duplicate indirect references, leading to exponential expansion of page references when processing a crafted PDF. This results in disproportionate CPU usage during the append operation. The issue is fixed in version 13.0.0.
CVE-2026-96643 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 11.0.0 up to but not including 13.0.0. The flaw involves inefficient algorithmic complexity in the Exif.load() function, which processes EXIF data in image files. Specifically, an uncapped PNG eXIf chunk with repeated headers can cause quadratic CPU usage due to repeated slicing and copying operations. This issue can be triggered through common image processing workflows such as Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(). The vulnerability is fixed in version 13.0.0.
CVE-2026-114143 is a high-severity vulnerability in the toml-node library for Node.js and browsers. Versions prior to 5.0.1 suffer from an inefficient algorithmic complexity issue in the parsing of long dotted keys and table headers, causing quadratic processing time. This can block the Node.js event loop for several seconds or lead to process termination due to memory exhaustion. The maxDepth option does not mitigate this issue. The vulnerability is fixed in version 5.0.1.
CVE-2026-114141 is a high-severity vulnerability in the toml-node library, a TOML parser for Node.js and browsers. Versions prior to 5.0.1 contain an inefficient algorithmic complexity issue in the addTableArray() function, causing quadratic synchronous processing when parsing documents with many array-of-tables headers. This can block the Node.js event loop and result in a denial of service. The issue is fixed in version 5.0.1.
Django REST framework versions prior to 3.18.2 have an uncontrolled resource consumption vulnerability in the DefaultContentNegotiation.get_accept_list method. An unauthenticated attacker can exploit this by sending requests with many distinct media types containing large quoted parameter values, causing excessive CPU usage and denial of service. The issue is fixed in version 3.18.2.
CVE-2026-114129 is an inefficient algorithmic complexity vulnerability in the FlexAssembler component of the stream-json package. The issue arises because the FlexAssembler uses a string or RegExp filter that triggers a costly path join operation on every container start, with no limit on JSON nesting depth. This results in quadratic CPU consumption relative to the nesting depth, allowing an attacker to stall the Node.js event loop with a crafted deeply nested JSON input. The vulnerability causes an availability impact by blocking the event loop, but does not affect confidentiality or integrity. The issue is fixed in stream-json version 3.7.0.
CVE-2026-113789 is a vulnerability in the py-pdf pypdf library prior to version 6.21.0. It allows an attacker to craft a malicious PDF that triggers excessive memory consumption or prolonged runtimes when an application processes the document's form fields. This uncontrolled resource consumption issue is addressed in pypdf version 6.21.0.
CVE-2026-19630 is a vulnerability in ISC BIND 9 DNS resolver where specially crafted inbound DNS messages with a particular structure cause excessive CPU and memory consumption. This occurs because BIND imposes no limit on processing these structures, leading to inefficient algorithmic complexity. The issue affects multiple BIND 9 versions from 9.11.0 through 9.21.26 and their corresponding S1 variants.
CVE-2026-113729 is a high-severity vulnerability in the moov-io signedxml Go library prior to version 1.4.1. The issue involves uncontrolled resource consumption caused by the ExclusiveCanonicalization function copying the entire accumulated namespace map at every nested XML element. An attacker can craft a deeply nested XML document with many unused namespace declarations, causing excessive memory allocation and potentially terminating the process. This vulnerability can be triggered through the ValidateReferences function without requiring a valid signature or authentication. The flaw is fixed in version 1.4.1.
markdown-it versions 14.1.0 through before 14.3.3 and 15.0.0 through before 15.0.3 contain a vulnerability causing uncontrolled resource consumption (CWE-400). This occurs when processing a link reference definition with an unclosed label or title, leading to quadratic time complexity in parsing. The issue has been fixed in versions 14.3.3 and 15.0.3.
CVE-2026-112894 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 5.1.0 up to but not including 13.0.0. It causes a quadratic-time denial-of-service (DoS) when saving multi-frame images as multi-page PDFs due to inefficient algorithmic complexity in the PDF writer's object ID reservation process. This inefficiency leads to excessive CPU usage proportional to the square of the frame count, allowing an attacker to tie up system resources for extended periods with crafted files. The issue was fixed in version 13.0.0.
CVE-2026-112891 is a vulnerability in the python-pillow Pillow library versions 9.2.0 up to but not including 13.0.0. It involves inefficient algorithmic complexity in handling GIF images with long comments, causing repeated copying of comment portions during saving. This can lead to CPU resource exhaustion and a denial of service if crafted images are processed automatically by a network service. The issue is fixed in version 13.0.0.
CVE-2026-112401 is an inefficient algorithmic complexity vulnerability in the python-pillow Pillow library affecting GIF comment processing. The flaw causes Image.open() to consume CPU time quadratically relative to the size of crafted GIF comment extensions, leading to denial-of-service (DoS) via processor exhaustion. This occurs because the code repeatedly concatenates immutable bytes objects without size limits, causing excessive copying. The issue affects Pillow versions from 5.4.0 up to but not including 13.0.0 and was fixed in version 13.0.0.
CVE-2026-111766 is a denial-of-service vulnerability in markdown-it, a Markdown parser. It occurs in versions prior to 14.3.3 and 15.0.3 when the html option or commonmark preset is enabled. The vulnerability is triggered by attacker-controlled Markdown containing repeated unterminated inline HTML comments or similar constructs inside a paragraph. This causes the parser to perform quadratic processing, leading to event-loop blocking or an unresponsive browser main thread. The issue does not affect HTML blocks or the default HTML-disabled configuration. Fixed in versions 14.3.3 and 15.0.3.
CVE-2026-110688 is a vulnerability in Cpanel::JSON::XS Perl module versions 4.51 up to but not including 4.80. It causes inefficient algorithmic complexity resulting in quadratic CPU usage during JSON parsing when processing non-ASCII input. This can lead to significant CPU resource consumption and process delays when parsing large JSON payloads containing non-ASCII characters.