markdown-it versions prior to 14.3.2 and 15.0.2 have a vulnerability in the smartquotes rule when the typographer option is enabled. Specially crafted Markdown input can cause quadratic processing time, leading to potential denial of service due to uncontrolled resource consumption. The default configuration with typographer disabled is not affected. This issue is fixed in versions 14.3.2 and 15.0.2.
Text::CSV_XS versions before 1.65 for Perl have an inefficient algorithmic complexity vulnerability (CWE-407) that causes quadratic CPU usage when processing CSV input with carriage return (CR)-only line endings. This occurs because the getline function copies the entire unparsed remainder of the input after each record, leading to CPU time growing quadratically with input size. This can cause significant performance degradation when parsing large CSV files with classic Mac line endings.
CVE-2026-77474 is a high-severity vulnerability in destructive_command_guard (dcg), a command-line safety tool that blocks destructive shell commands before AI coding agents execute them. Versions prior to 0.6.6 are affected by uncontrolled resource consumption due to recursive rescanning triggered by nested or unclosed substitution sequences like $( or $((. This leads to exponential-time processing and can cause the PreToolUse hook to hang and fail open, allowing destructive commands to proceed. The issue is fixed in version 0.6.6.
CVE-2026-101021 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the MultipartInputStream component performs inefficient boundary matching and unnecessary buffer copying. This flaw allows crafted multipart input to cause excessive boundary comparisons and repeated copying, leading to a high-severity impact on availability.
CVE-2026-96958 is a vulnerability in Microsoft .NET Framework 3.5 involving inefficient algorithmic complexity that allows an unauthorized attacker to cause a denial of service over a network. The flaw affects multiple versions of the .NET Framework including 3.0.0.0, 3.5.0, and several 4.x and 10.x versions. Microsoft has released official fixes for this issue in versions 4.7.4150.0, 4.8.4811.0, 4.8.9363.0, and 10.0.13. The vulnerability has a CVSS score of 7.5, indicating high severity, and does not impact confidentiality or integrity but causes availability disruption. No known exploits are reported in the wild at this time.
CVE-2026-84008 is a high-severity vulnerability in Microsoft .NET Framework 3.5 and related versions caused by inefficient algorithmic complexity. This flaw allows an unauthorized attacker to perform a denial of service (DoS) attack over a network by exploiting the inefficient processing. The issue affects multiple versions of the .NET Framework and has been officially fixed in specified later versions.
CVE-2026-70196 is a vulnerability in Microsoft ASP.NET Core 10.0 involving inefficient algorithmic complexity that allows an unauthorized attacker to cause a denial of service (DoS) over a network. The flaw affects multiple versions of ASP.NET Core prior to fixed releases. The vulnerability has a medium severity rating with a CVSS score of 5.9. Official fixes are available in specified patched versions.
CVE-2026-69651 is a vulnerability in Microsoft .NET 10.0 runtime involving inefficient algorithmic complexity that allows an unauthorized attacker to cause a denial of service over a network. The flaw affects multiple versions of the .NET runtime prior to fixed releases. Microsoft has issued official fixes for the affected versions. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits are reported in the wild at this time.
CVE-2026-107378 is a high-severity vulnerability in Kozea CairoSVG versions prior to 2.9.1 caused by inefficient algorithmic complexity in SVG path rendering. The vulnerability arises from two independent O(n²) operations in the path parser and marker handling code, leading to excessive CPU usage when rendering SVGs with many path segments. An attacker can exploit this by submitting a crafted SVG with a large number of path segments, causing denial of service due to high CPU consumption during rendering.
### Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
### Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
### Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
CVE-2026-107287 is a medium severity vulnerability in pydantic-ai affecting versions from 1.77.0 up to but not including 1.107.7, and from 2.0.0b1 up to but not including 2.52.0. The issue involves uncontrolled resource consumption during HTML-to-Markdown conversion of attacker-controlled HTML with deeply nested block elements, causing excessive CPU and memory use. This can delay processing of other tasks. The vulnerability is fixed in versions 1.107.7 and 2.52.0.
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answer anybody.
Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to answer anybody. The IMAP PREVIEW response read such text the same way, holding an IMAP thread for each client that asks for the preview of such a message. The flaw is in the server's shared string class, whose replace and remove both ran in quadratic time.
Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position, so a long SEARCH TEXT key over a message cost the product of the two lengths; SEARCH message sets and the saved-result marker ($), SORT criteria, HEADER.FIELDS name lists and UID ranges were each read once per message rather than once per command; and a FETCH naming a message's sections very many times read and held every section in memory before sending any. An IMAP command may continue past one line through non-synchronizing literals, so one command can reach about eleven megabytes. The IMAP worker threads are a small pool shared with SMTP and POP3, so a signed-in user sending such commands can make the IMAP, SMTP and POP3 services stop responding (CWE-407) and can consume excessive memory (CWE-400).
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tests a header, a spam tag is added to the Subject or an abuse report is read during delivery. The IMAP worker threads are shared with SMTP and POP3, so a few such messages stop those services responding. The server's reading of a message header from its file also searched everything read so far after each 4,000 bytes, costing seconds for a header of tens of megabytes.
Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messages a minute keep every delivery thread busy.
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header: the 'simple' canonicalisation prepended each continuation line of a folded field to the lines already gathered, and both canonicalisations searched the gathered fields from the bottom for each h= name and erased the match from the middle of the list. A message whose header holds very many fields, or a field folded over very many lines, with a DKIM-Signature the attacker signs for a domain they control, keeps a worker thread busy for tens of seconds per signature; up to ten signatures are evaluated per message by each of the DKIM and DMARC tests, on the threads that serve delivery and SMTP.
Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.
Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding the REST API's own worker threads. Where no report mailbox is configured, the unauthenticated REST sign-in routes that read a JSON body are capped at 64 KB and are not affected.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.utils.http.parse_header_parameters()` was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as `Accept` or `Content-Type`, for instance via the content negotiation performed by `HttpRequest.accepts()`. The per-call length limit does not bound the combined size of repeated headers.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Jisung Chae for reporting this issue.