Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to exhaust CPU and memory via an oversized base62 segment in a submitted API key.
AshAuthentication.Base.decode62/1 in lib/ash_authentication/base.ex splits its argument into one binary per character and folds it with charval62/2, which recomputes Integer.pow(62, index) at every position instead of accumulating by Horner's method, so cost grows roughly cubically in the input length. bindecode62/1 in the same module is quadratic through Integer.undigits/2 and Integer.digits/2. Neither function caps byte_size/1, and AshAuthentication.Strategy.ApiKey.SignInPreparation passes the underscore-separated segments of the submitted key straight into both, before any key lookup and without prior authentication. The surrounding rescue clauses catch exceptions, not CPU or memory exhaustion.
This issue affects ash_authentication: from 4.8.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
CVE-2026-19668 is a vulnerability in ISC BIND 9 recursive resolver where processing large numbers of certain invalid DNSSEC records can cause excessive resource consumption. Default limits on "max-records-per-type" and "max-types-per-name" provide some mitigation. This affects multiple BIND 9 versions from 9.11.0 through 9.21.25 and their respective S1 variants.
Conform, a type-safe form validation library, has an inefficient algorithmic complexity vulnerability in its parseSubmission API from versions 1.8.0 up to but not including 1.19.4. This flaw allows an unauthenticated attacker to submit a form with many unique field names, causing excessive CPU usage and potential denial of service. The issue is fixed in version 1.19.4.
Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service.
parse_hex_prefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an arbitrary-precision accumulator with acc * 16 + digit and imposes no limit on the digit count. Because the accumulator grows without bound, the multiplication is not constant time and one pass over N digits costs O(N squared). handle_data/2 prepends conn.buffer and re-parses from the start on every socket message, so a server that dribbles the digits out in small packets makes the client pay that cost repeatedly. A run of roughly 512,000 hex digits costs over ten seconds of CPU in a single pass, measured on stock defaults. The parser reaches this state after a valid status line and a complete, valid header section, so an intermediary inspecting only headers sees an ordinary 200 response.
This issue affects mint: from 1.9.3 before 1.10.0.
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.5.0, the path filters pick, ignore, filter, and replace in src/core/filters/filter-base.js recompute the full path string from the nesting stack for every checkable token. Because the stack length equals the current nesting depth and a checkable token is emitted at every level, a depth D document costs O(D²) rather than O(D) to process. The issue is triggered by nesting depth rather than byte volume, including the documented pick({filter: 'data'}) traversal-until-match path, so an application that sends untrusted JSON through a string or RegExp filter can block the Node.js event loop and cause denial of service with a small deeply nested document. The streamArray, streamObject, and streamValues streamers are not affected because they use the constant-time asm.depth getter. This issue is fixed in version 3.5.0.
### Summary
HTTPX2's Server-Sent Events (SSE) parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this behavior to consume excessive client CPU.
### Details
Before version 2.10.0, HTTPX2 combined the complete pending SSE line with each newly received chunk and then scanned the combined text for line separators. If an SSE server sends a long line as many small chunks without a line separator, every chunk causes all previously received text to be copied and scanned again. For `n` fixed-size chunks, this results in O(n²) processing.
The behavior affects both `httpx2.Client.sse()` and `httpx2.AsyncClient.sse()`. Other response APIs do not use the SSE parsing path.
### Impact
Applications that consume SSE from an attacker-controlled or compromised endpoint can experience excessive CPU usage. A crafted stream can block a synchronous worker or the asynchronous event loop that is consuming it, degrading availability for other work in that process. Confidentiality and integrity are not affected.
### Mitigation
Upgrade to HTTPX2 2.10.0 or later. SSE parsing now accumulates incomplete line fragments and combines them only when necessary, making processing linear in the amount of received data. HTTPX2 2.10.0 also limits buffered SSE events to 1 MiB by default through `max_event_size`.
If upgrading is not immediately possible, only consume SSE from trusted endpoints and enforce an external size or time budget on the stream.
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.
CVE-2026-49329 is a denial of service vulnerability in Red Hat OpenShift Container Platform 4.14's OAuth server. It arises from improper input validation of the Accept-Language HTTP header, allowing an unauthenticated attacker to trigger a quadratic-time parsing algorithm. This excessive CPU consumption can deny authentication service to all cluster users. The vulnerability bypasses previous mitigations by exploiting underscore separators in the header. Until a vendor fix is released, mitigation involves deploying an external TLS-terminating proxy or WAF to limit header size and rate-limit unauthenticated requests.
CVE-2026-82398 is an inefficient algorithmic complexity vulnerability in the py-pdf pypdf library. An attacker can craft a specially designed PDF that triggers long runtimes by causing the function read_until_whitespace to process input lacking whitespace for an extended period. This can lead to performance degradation when parsing such PDFs. The issue has been fixed in pypdf version 6.15.0. Users unable to upgrade immediately may apply the changes from pull request #3947 as a workaround.
CVE-2026-77831 is an inefficient algorithmic complexity vulnerability in the ash-project's ash_paper_trail library. It allows a user who can submit a large array attribute during a paper-trailed create or update action to cause a denial of service by consuming excessive CPU and memory resources. The vulnerability arises from the way the library pairs prior array elements with new ones, resulting in cubic scaling of resource use relative to the array length. This affects versions from 0.1.1 up to but not including 0.7.0.
CVE-2026-75005 is an Inefficient Algorithmic Complexity vulnerability in Apache APISIX version 3.17.0. A specially crafted small request targeting graphql-limit-count routes can cause a gateway worker to consume 100% CPU for an extended period. This can degrade service performance or availability. The issue is fixed in Apache APISIX version 3.18.0.
A denial of service vulnerability exists in the collective icalendar Python library versions from 7.1.0 up to but not including 7.1.3. The vulnerability arises from an exponential time complexity in the Component equality method when comparing deeply nested subcomponents, which can be exploited by submitting crafted .ics files with nested BEGIN:VEVENT blocks. This causes excessive CPU consumption during certain comparison operations, potentially pinning a CPU core for minutes or indefinitely. The issue is fixed in version 7.1.3.
CVE-2026-75596 is a high-severity vulnerability in the Netty framework affecting versions prior to 4.1.137.Final and between 4.2.0.Final and before 4.2.17.Final. It involves inefficient algorithmic complexity in the TLS handshake processing, where an unauthenticated remote peer can cause excessive CPU usage by sending a large ClientHello message fragmented into many small TLS records. This results in quadratic CPU workload on the event loop, degrading TLS handling performance for other clients. The issue is fixed in Netty versions 4.1.137.Final and 4.2.17.Final.
CVE-2026-71491 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue involves uncontrolled resource consumption due to the group_comments function repeatedly rescanning comment-only SQL statements, leading to quadratic CPU usage during parsing and formatting operations. This vulnerability can cause significant performance degradation when processing certain SQL inputs. The issue is fixed in sqlparse version 0.6.0.
CVE-2026-54284 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue arises from inefficient algorithmic complexity during TokenList construction and string conversion, causing quadratic CPU consumption when using sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This inefficiency is due to repeatedly flattening nested token subtrees. The vulnerability is fixed in sqlparse version 0.6.0.