PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94653 is a high-severity vulnerability in Apache Thrift affecting PHP bindings before version 0.25.0. It involves inefficient algorithmic complexity, which can lead to performance degradation or denial of service. The issue is fixed in Apache Thrift version 0.25.0.
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85494 is a high-severity vulnerability in Apache Thrift affecting versions before 0.25.0. It involves improper handling of length parameter inconsistencies leading to uncaught exceptions, inefficient algorithmic complexity, excessive memory allocation, and insecure resource initialization across multiple language bindings. The issue is fixed in version 0.25.0.
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a certificate, CRL, certification request or other structure whose name contains a long attribute value made up of characters that must be escaped, such as commas, or of leading or trailing spaces, because each escaping backslash was inserted into the buffer being scanned, so the work grew quadratically with the length of the value. Applications are exposed when they convert such a name to a string, for example to log or display it, or compare it with IetfUtilities.RdnAreEqual, as PKIX path validation does for directoryName name constraints.
CVE-2026-104182 is an inefficient algorithmic complexity vulnerability in the JSONC parser and verifier components of the uhop stream-json library prior to version 3.6.0. The issue arises when processing large valid comments split across many small input chunks, causing quadratic CPU usage and potentially stalling the Node.js event loop. This vulnerability affects only the JSONC parser, not the plain JSON parser. The maintainer notes the attack vector is local, involving user-controlled or locally owned configuration input rather than internet-facing input. The issue is fixed in version 3.6.0.
CVE-2026-102999 is a high-severity vulnerability in the pypdf library prior to version 6.19.0. It involves uncontrolled resource consumption caused by the dictionary-based attachments API reparsing the full attachment list repeatedly when processing crafted PDFs with many embedded files. This leads to excessive CPU usage and long runtimes during embedded-file mapping access. The issue is fixed in pypdf version 6.19.0.
pypdf versions prior to 6.18.1 contain a vulnerability where a crafted PDF with a malformed /FlateDecode stream causes inefficient byte-by-byte decompression. This leads to excessive resource consumption, resulting in long runtimes and potential application unavailability. The issue is a residual problem after a previous fix related to malformed FlateDecode recovery. The vulnerability is fixed in version 6.18.1.
CVE-2026-102994 is a high-severity vulnerability in the pypdf library prior to version 6.18.0. It involves uncontrolled resource consumption caused by crafted PDFs containing long sequences of indirect-object identifiers or generation-number tokens without whitespace. This leads to excessive scanning in specific pypdf modules, resulting in long runtimes and potential application unavailability. The issue is resolved in pypdf version 6.18.0.
CVE-2026-102277 is a medium severity vulnerability in the juliangruber brace-expansion library that causes uncontrolled resource consumption. The expand function in affected versions repeatedly rescans input patterns with many trailing closing braces, leading to quadratic CPU and memory usage. This results in a recoverable denial of service by blocking the Node.js event loop. The issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
CVE-2026-67419 is a high-severity vulnerability in rabbitmq-server prior to version 4.3.5. It involves inefficient algorithmic complexity in topic exchange routing, where an authenticated user with permissions to bind queues and publish messages can exploit consecutive '#' segments in binding keys. This causes excessive CPU and memory usage due to duplicate processing in topic matchers, potentially disrupting message routing for all tenants. The issue is fixed in version 4.3.5.
Jawn is an open source JSON parser with a vulnerability in its AsyncParser component prior to version 1.7.0. The AsyncParser can perform quadratic work when processing a single JSON token delivered in many small chunks, leading to excessive CPU consumption. This can be exploited by a remote attacker controlling untrusted JSON input and chunk sizes to cause a denial of service. The issue is fixed in version 1.7.0.
Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake.
The BER OID decoder asn1rtt_ber:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_ber.erl and the equivalent PER helper asn1rtt_per_common:dec_subidentifiers/3 in lib/asn1/src/asn1rtt_per_common.erl accumulate a base-128 subidentifier into an unbounded integer using (Av bsl 7) + H per continuation byte. Each shift and addition on the growing accumulator is linear in the number of bits already accumulated, giving quadratic total work in the size of a single subidentifier. The JER helper asn1rtt_jer:json2oid/1 in lib/asn1/src/asn1rtt_jer.erl exhibits the same class of unbounded-integer parsing when decoding a dot-separated OID from JSON. A DER-encoded OBJECT IDENTIFIER with one very large arc (approximately 262 KB of continuation bytes) consumes roughly 13 seconds of CPU on typical hardware.
The vulnerable decoder is generated into every ASN.1 module that contains an OBJECT IDENTIFIER, including OTP-PUB-KEY which is reached during X.509 certificate parsing via public_key:pkix_decode_cert/2. This decoder runs before any signature or trust chain verification, so any Erlang service that parses peer TLS certificates is exposed: the default for TLS clients (which always parse the server certificate) and for mutual-TLS servers (which parse client certificates).
This vulnerability is associated with program files lib/asn1/src/asn1rtt_ber.erl, lib/asn1/src/asn1rtt_per_common.erl and lib/asn1/src/asn1rtt_jer.erl and program routines asn1rtt_ber:dec_subidentifiers/3, asn1rtt_per_common:dec_subidentifiers/3 and asn1rtt_jer:json2oid/1.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.18, OTP 28.5.0.7, and OTP 29.1.1, corresponding to asn1 from 3.0 before 5.3.4.3, 5.4.3.1, and 5.5.2. Whether OTP before OTP 17.0, corresponding to asn1 before 3.0, is affected is unknown.
CVE-2026-87081 is a vulnerability in Net::IDN::UTS46 versions before 2.590 for Perl that allows CPU exhaustion via inefficient algorithmic complexity in punycode encoding. The flaw arises because the to_ascii function punycode encodes each label before applying the 63-byte DNS length limit, leading to quadratic time complexity when processing labels with many distinct non-ASCII characters. This can cause denial of service by exhausting CPU resources during encoding operations.
CVE-2026-87079 is a high-severity vulnerability in Net::IDN::Punycode versions before 2.590 for Perl. It allows an attacker to cause CPU exhaustion due to inefficient quadratic-time processing when decoding long labels in the decode_punycode function. The vulnerability arises because the XS backend scans the UTF-8 buffer from the start for each code point insertion, and the pure-Perl backend similarly incurs quadratic cost when handling UTF-8 flagged input. There is no length bound on labels when converting to Unicode, enabling attackers to supply arbitrarily long labels to trigger this behavior.