CVE-2026-123792 is an inefficient algorithmic complexity vulnerability in the Symfony Yaml component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The vulnerability causes the YAML parser to perform excessive repeated work when processing certain crafted YAML documents, leading to exponential or quadratic parsing time growth. This can keep a PHP process busy for extended periods, potentially causing denial of service. The issue affects any code parsing untrusted YAML with default flags, including some Symfony request payload mappings that accept YAML input without restrictions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7.
CVE-2026-106554 is an algorithmic complexity vulnerability in the jackson-dataformat-cbor library's CBOR parser. The parser accumulates CBOR semantic tags in a TagList that grows by a fixed increment, causing quadratic-time growth in CPU and garbage collection when processing an unbounded run of tags. This can lead to denial of service by exhausting CPU and GC resources. The issue affects multiple 2.x and 3.x versions and has been fixed by improving TagList growth and capping stacked tags.
Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-Language` header from `LanguageMiddlewareFunc` through `GetLanguagePreference` to `golang.org/x/text/language.ParseAcceptLanguage` without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, even though the internal parser normalizes underscores to hyphens. Long lists of underscore-separated language subtags longer than eight characters bypass the guard. These subtags fail the `len <= 8` length check in `golang.org/x/text/internal/language/parse.go`, causing repeated `gobble` operations to move the entire remaining buffer through `runtime.memmove`. With many invalid subtags, this repeated buffer movement takes quadratic work. Unauthenticated requests to the public landing page or `/api` can consume disproportionate CPU, with a 256 KiB header already causing seconds of processing and larger input permitted by the default 1 MiB header ceiling. `resource.CheckErr` also logs the entire invalid header, amplifying cost, while normal successful HTTP responses can conceal the denial-of-service traffic. Repeated requests can saturate server CPU. This issue is fixed in version 0.12.26.
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.
_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop.
An attacker who controls the number of seconds added can keep the process busy for as long as they choose.
CVE-2026-119197 is a vulnerability in the pyasn1 Python library prior to version 0.6.5. It involves inefficient algorithmic complexity in decoding binary REAL values, where the decoding process is quadratic in the length of the mantissa. An attacker can craft ASN.1 data with a large mantissa to cause excessive CPU usage, leading to denial of service. The issue is fixed in pyasn1 version 0.6.5.
CVE-2026-119196 is a high-severity vulnerability in the pyasn1 Python library prior to version 0.6.5. It involves inefficient algorithmic complexity in decoding constructed BIT STRING values, where repeated shifting and copying of bit values during decoding can cause quadratic CPU usage. This can lead to CPU exhaustion when processing large fragmented BIT STRING inputs. The issue is fixed in pyasn1 version 0.6.5.
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
CVE-2026-119194 is a high-severity vulnerability in the pyasn1 Python library affecting versions from 0.3.3 up to but not including 0.6.5. The flaw involves inefficient algorithmic complexity in schemaless container decoding, where an attacker can craft BER, CER, or DER inputs with many distinct long tag IDs causing hash collisions. This leads to quadratic CPU usage during decoding, potentially exhausting CPU resources and reducing service availability. The issue is fixed in version 0.6.5.
CVE-2026-118664 is a high-severity vulnerability in the decode-uri-component library prior to version 0.5.1. The issue arises from the fallback mechanism in decodeUriComponent, which processes malformed percent-encoded input inefficiently, causing quadratic CPU consumption and blocking the Node.js event loop. This can lead to denial of service when processing large or crafted request bodies. The vulnerability is fixed in version 0.5.1.
CVE-2026-116270 is a high-severity vulnerability in MIME-tools Perl module versions before 5.521. It involves inefficient algorithmic complexity in the decode_mimewords function, which can be exploited by sending repeated "=?" sequences. This causes memory exhaustion by appending large error messages repeatedly, potentially leading to denial of service. The issue affects MIME::Words and MIME::Parser components, with the latter decoding multipart boundaries in a way that allows remote attackers to exhaust memory via a crafted Content-Type header. The vulnerability is fixed in version 5.521.
CVE-2026-116267 is a vulnerability in MIME::Parser for Perl versions before 5.521 that allows memory exhaustion via inefficient handling of deeply nested MIME messages. The parser logs error diagnostics indented by three spaces per nesting level, and when a deeply nested message is truncated without closing boundaries, the error logs grow quadratically with the nesting depth. This can lead to denial of service due to resource exhaustion. The issue is fixed in version 5.521.
CVE-2026-116133 is a high-severity vulnerability in HTTP::Body for Perl versions before 1.23_01. It involves inefficient algorithmic complexity in the multipart body parser, which can cause CPU exhaustion. The parser rescans the entire buffered body repeatedly when a multipart boundary is missing or malformed, leading to quadratic time complexity. This allows a remote attacker to exhaust server CPU resources by sending crafted HTTP requests with malformed multipart bodies.
CVE-2026-116795 is a vulnerability in the le0pard re2js JavaScript regular expression engine versions 2.2.0 through 2.8.6. When LOOKBEHINDS are enabled and repeated matching functions like matcher().find(), matchAll(), split(), or matcher().replaceAll() are used, the engine can perform quadratic work due to inefficient algorithmic complexity. This causes excessive rescanning of input, potentially allowing attacker-controlled input to monopolize a single-threaded worker and cause denial of service. The issue is fixed in version 2.8.7.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.
CVE-2026-78661 is a high-severity vulnerability in the golang.org/x/net/html package that causes inefficient algorithmic complexity during text node coalescing. The issue arises from repeated string concatenations that lead to O(n^2) allocations and byte copies when parsing inputs with many short text runs separated by ignored end tags. This inefficiency can cause significant performance degradation during HTML parsing. The flaw is fixed in version 0.62.0 of the package.
CVE-2026-116587 is a vulnerability in go-jose prior to version 4.1.6 where attacker-controlled RSA parameters in JSON Web Keys (JWKs) are parsed without proper size and consistency checks. On Go 1.24 and later, this can cause the RSA key validation to consume cubic CPU time, leading to a remote denial of service (DoS). The issue is fixed in go-jose version 4.1.6.
CVE-2026-116577 is a vulnerability in the Tornado Python web framework prior to version 6.6. The HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. This allows an unauthenticated client to submit specially crafted headers that block other connections by exhausting CPU resources. The issue affects availability only and is fixed in Tornado version 6.6.
CVE-2026-65631 is an inefficient algorithmic complexity vulnerability in the potatosalad jose library versions from 1.7.7 up to but not including 1.11.13. It allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key that triggers expensive factoring operations. The issue is fixed in version 1.11.13.
CVE-2026-108529 is an inefficient algorithmic complexity vulnerability in the HTTP/2 implementation of the mtrudel bandit server. An unauthenticated remote attacker can exhaust the server CPU by sending many small SETTINGS or connection-level WINDOW_UPDATE frames that cause excessive processing overhead. The issue arises because the server's retry logic for blocked streams uses an O(n²) list operation, which can be exploited by opening thousands of streams. This vulnerability affects bandit versions from 0.3.4 up to but not including 1.14.0 and has been fixed in version 1.14.0.