Common Weakness Enumeration
CWE-407
Weakness Allowed-with-ReviewInefficient Algorithmic Complexity
Abstraction: Class · Status: Incomplete
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Mapping guidance
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
Modes of introduction
Architecture and Design
Implementation
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Content history
Submission: PLOVER
· 2006-07-19
· CWE Draft 3
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2009-07-27
· CWE 1.5
updated Functional_Areas, Other_Notes
Modification: CWE Content Team
· MITRE
· 2009-10-29
· CWE 1.6
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Applicable_Platforms, Likelihood_of_Exploit
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Observed_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Relationships
Modification: CWE Content Team
· MITRE
· 2015-12-07
· CWE 2.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Likelihood_of_Exploit
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Name, Relationships, Type
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-08-20
· CWE 4.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-03-15
· CWE 4.4
updated References, Relationships
Modification: CWE Content Team
· MITRE
· 2021-07-20
· CWE 4.5
updated References
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Alternate_Terms, Observed_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Demonstrative_Examples, Observed_Examples, References
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Detection_Factors, References
529 vulnerabilities reference this CWE, most recent first.
CVE-2026-123792 (GCVE-0-2026-123792)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:19 – Updated: 2026-11-06 15:19
VLAI
EPSS
VEX
Title
Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
Summary
The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
The parser repeats work it has already done in several places. An embedded mapping in a flow sequence is parsed again for every scalar appended to it, and so are the collections nested in it, so the parse time grows exponentially with the nesting depth. The patterns matching mapping keys and tags scan a run of spaces once per character of the run, and each scalar of a flow collection is matched against a copy of the rest of the collection, so the parse time grows quadratically with the size of the input. Nested blocks are also copied at each nesting level, which consumes memory as well as time. A few other constructs, such as an empty sequence item followed by a blank line or an anchor named 0, trigger similar repeated work.
Any code parsing untrusted YAML is affected, with the default flags. In Symfony 7.4 and later, that includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat. A single unauthenticated request with a YAML content type keeps a PHP worker busy until max_execution_time. JSON documents are valid YAML, so a JSON payload sent with a YAML content type is enough for the flow collection case. In Symfony 6.4, #[MapRequestPayload] accepts YAML only when the application registers a yaml request format.
Severity
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://github.com/symfony/symfony/commit/487f63b… | patch |
| https://github.com/symfony/symfony/commit/08db22d… | patch |
| https://github.com/symfony/symfony/commit/49e0303… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
0 , < 5.4.56
(git)
Affected: 6.0.0 , < 6.4.50 (git) Affected: 7.0.0 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
Date Public
2026-11-06 15:19
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/yaml",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\Yaml\\Inline",
"Symfony\\Component\\Yaml\\Parser"
],
"packageName": "symfony/yaml",
"product": "symfony",
"repo": "https://github.com/symfony/yaml",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "5.4.56",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"lessThan": "6.4.50",
"status": "affected",
"version": "6.0.0",
"versionType": "git"
},
{
"lessThan": "7.4.23",
"status": "affected",
"version": "7.0.0",
"versionType": "git"
},
{
"lessThan": "8.1.11",
"status": "affected",
"version": "8.0.0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.56",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.50",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.23",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.11",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sebastian Bergmann"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"datePublic": "2026-11-06T15:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe Symfony Yaml components\u0026nbsp;\u003ccode\u003eInline\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003eParser\u003c/code\u003e, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/div\u003e\u003cdiv\u003eThe parser repeats work it has already done in several places. An embedded mapping in a flow sequence is parsed again for every scalar appended to it, and so are the collections nested in it, so the parse time grows exponentially with the nesting depth. The patterns matching mapping keys and tags scan a run of spaces once per character of the run, and each scalar of a flow collection is matched against a copy of the rest of the collection, so the parse time grows quadratically with the size of the input. Nested blocks are also copied at each nesting level, which consumes memory as well as time. A few other constructs, such as an empty sequence item followed by a blank line or an anchor named \u003ccode\u003e0\u003c/code\u003e, trigger similar repeated work.\u003c/div\u003e\u003cdiv\u003e\nAny code parsing untrusted YAML is affected, with the default flags. In Symfony 7.4 and later, that includes \u003ccode\u003e#[MapRequestPayload]\u003c/code\u003e when the Yaml component is installed and the endpoint does not restrict \u003ccode\u003eacceptFormat\u003c/code\u003e. A single unauthenticated request with a YAML content type keeps a PHP worker busy until \u003ccode\u003emax_execution_time\u003c/code\u003e. JSON documents are valid YAML, so a JSON payload sent with a YAML content type is enough for the flow collection case. In Symfony 6.4, \u003ccode\u003e#[MapRequestPayload]\u003c/code\u003e accepts YAML only when the application registers a \u003ccode\u003eyaml\u003c/code\u003e request format.\u003c/div\u003e"
}
],
"value": "The Symfony Yaml components\u00a0Inline\u00a0and\u00a0Parser, parse some YAML documents inefficiently, so that a small crafted document can take disproportionately long to process, keeping a PHP process busy for seconds or minutes, potentially causing a denial of service in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\nThe parser repeats work it has already done in several places. An embedded mapping in a flow sequence is parsed again for every scalar appended to it, and so are the collections nested in it, so the parse time grows exponentially with the nesting depth. The patterns matching mapping keys and tags scan a run of spaces once per character of the run, and each scalar of a flow collection is matched against a copy of the rest of the collection, so the parse time grows quadratically with the size of the input. Nested blocks are also copied at each nesting level, which consumes memory as well as time. A few other constructs, such as an empty sequence item followed by a blank line or an anchor named 0, trigger similar repeated work.\n\n\nAny code parsing untrusted YAML is affected, with the default flags. In Symfony 7.4 and later, that includes #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat. A single unauthenticated request with a YAML content type keeps a PHP worker busy until max_execution_time. JSON documents are valid YAML, so a JSON payload sent with a YAML content type is enough for the flow collection case. In Symfony 6.4, #[MapRequestPayload] accepts YAML only when the application registers a yaml request format."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient regular expression complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:19:58.366Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-hwfg-qwvh-2wfx"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/487f63bf2cacebc8ed8273c5c10d92955acd2402"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/08db22d52e5d3e6ec2f5c50db30a4d818100ffb9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/49e03035eda3000e978a4612db74900013255ccd"
}
],
"source": {
"advisory": "GHSA-hwfg-qwvh-2wfx",
"discovery": "UNKNOWN"
},
"title": "Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-123792",
"datePublished": "2026-11-06T15:19:58.366Z",
"dateReserved": "2026-11-06T14:48:55.784Z",
"dateUpdated": "2026-11-06T15:19:58.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123608 (GCVE-0-2026-123608)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-08 01:38
VLAI
EPSS
VEX
Title
Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression
Summary
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hickory-dns/hickory-dns/securi… | vendor-advisory |
| https://www.vulncheck.com/advisories/hickory-dns-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hickory-dns | hickory-dns |
Affected:
0.3.1 , < 0.26.1
(semver)
Unaffected: 0.26.1 (semver) |
Date Public
2026-05-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/hickory-proto",
"product": "hickory-dns",
"vendor": "hickory-dns",
"versions": [
{
"lessThan": "0.26.1",
"status": "affected",
"version": "0.3.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.26.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qifan-sailboat"
}
],
"datePublic": "2026-05-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate labels and trigger repeated linear scans during encoding, amplifying CPU exhaustion."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:34.124Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q2qq-hmj6-3wpp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp"
},
{
"name": "VulnCheck Advisory: Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hickory-dns-hickory-proto-0.3.1-before-0.26.1-cpu-exhaustion-via-binencoder-name-compression"
}
],
"title": "Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compression",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123608",
"datePublished": "2026-11-08T01:38:34.124Z",
"dateReserved": "2026-11-06T01:02:39.794Z",
"dateUpdated": "2026-11-08T01:38:34.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123559 (GCVE-0-2026-123559)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:38 – Updated: 2026-11-08 01:38
VLAI
EPSS
VEX
Title
Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation
Summary
Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ZcashFoundation/zebra/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/zebra-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZcashFoundation | zebra |
Affected:
0 , < 7.0.0
(semver)
Unaffected: 7.0.0 (semver) cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/zebrad",
"product": "zebra",
"vendor": "ZcashFoundation",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "asafmod"
},
{
"lang": "en",
"type": "coordinator",
"value": "mpguerra"
},
{
"lang": "en",
"type": "remediation developer",
"value": "conradoplg"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "upbqdn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:38:00.337Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j4cw-58mj-7w6v)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-j4cw-58mj-7w6v"
},
{
"name": "VulnCheck Advisory: Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zebra-before-7.0.0-denial-of-service-via-quadratic-sighash-computation"
}
],
"title": "Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123559",
"datePublished": "2026-11-08T01:38:00.337Z",
"dateReserved": "2026-11-06T00:50:45.483Z",
"dateUpdated": "2026-11-08T01:38:00.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123554 (GCVE-0-2026-123554)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check
Summary
Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ZcashFoundation/zebra/security… | vendor-advisory |
| https://github.com/ZcashFoundation/zebra/commit/0… | patch |
| https://www.vulncheck.com/advisories/zebra-zebrad… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ZcashFoundation | zebra |
Affected:
6.4.0 , < 7.0.0
(semver)
Unaffected: 7.0.0 (semver) cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/zebrad",
"product": "zebra",
"vendor": "ZcashFoundation",
"versions": [
{
"lessThan": "7.0.0",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zfnd:zebra:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0",
"versionStartIncluding": "6.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "janneh2000"
},
{
"lang": "en",
"type": "coordinator",
"value": "mpguerra"
},
{
"lang": "en",
"type": "remediation developer",
"value": "conradoplg"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction\u0027s output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:56.894Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7jp4-mq53-4cvq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-7jp4-mq53-4cvq"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/ZcashFoundation/zebra/commit/08743d669b33a19bce2a5d54001bd468c03a196e"
},
{
"name": "VulnCheck Advisory: Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zebra-zebrad-6.4.0-before-7.0.0-denial-of-service-via-mempool-coinbase-maturity-check"
}
],
"title": "Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123554",
"datePublished": "2026-11-08T01:37:56.894Z",
"dateReserved": "2026-11-06T00:49:30.576Z",
"dateUpdated": "2026-11-08T01:37:56.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122306 (GCVE-0-2026-122306)
Vulnerability from cvelistv5 – Published: 2026-11-05 02:25 – Updated: 2026-11-05 02:25
VLAI
EPSS
VEX
Title
Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching
Summary
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kyverno/kyverno/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/kyverno-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/kyverno/kyverno",
"product": "kyverno",
"vendor": "kyverno",
"versions": [
{
"lessThan": "1.19.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.19.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "1diot9"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts that block resource operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T02:25:10.219Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8mrj-27wr-599g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-8mrj-27wr-599g"
},
{
"name": "VulnCheck Advisory: Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-denial-of-service-via-exponential-time-wildcard-matching"
}
],
"title": "Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matching",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122306",
"datePublished": "2026-11-05T02:25:10.219Z",
"dateReserved": "2026-11-04T23:23:51.290Z",
"dateUpdated": "2026-11-05T02:25:10.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121437 (GCVE-0-2026-121437)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 16:59
VLAI
EPSS
VEX
Title
Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters
Summary
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:58 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/lepture/mistune/security/advis… | vendor-advisory |
| https://github.com/lepture/mistune/commit/b4dd328… | patch |
| https://www.vulncheck.com/advisories/mistune-3.3.… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121437",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:58:25.525426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:59:17.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/mistune",
"product": "mistune",
"vendor": "lepture",
"versions": [
{
"lessThan": "3.3.4",
"status": "affected",
"version": "3.3.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.3.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.3.4",
"versionStartIncluding": "3.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like \"*a_b\" to trigger an O(n\u00b2) index-fixup loop, stalling workers for seconds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:29.178Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qp42-r9j6-83g9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-qp42-r9j6-83g9"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/lepture/mistune/commit/b4dd3284e52ec741ed9a227db29ade9017828e90"
},
{
"name": "VulnCheck Advisory: Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mistune-3.3.0-before-3.3.4-quadratic-time-dos-via-process-emphasis-delimiters"
}
],
"title": "Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiters",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121437",
"datePublished": "2026-11-03T14:28:29.178Z",
"dateReserved": "2026-11-03T12:32:14.752Z",
"dateUpdated": "2026-11-03T16:59:17.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119741 (GCVE-0-2026-119741)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:26 – Updated: 2026-11-04 14:15
VLAI
EPSS
VEX
Title
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
Summary
rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:43 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/RsyncProject/rsync/releases/ta… | release-notes |
| https://github.com/RsyncProject/rsync/pull/1132 | patchissue-tracking |
| https://github.com/RsyncProject/rsync/commit/a740… | patch |
| https://github.com/RsyncProject/rsync/blob/a7404a… | technical-description |
| https://www.vulncheck.com/advisories/rsync-throug… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| RsyncProject | rsync |
Affected:
0 , ≤ 3.5.1
(semver)
Unaffected: 3.5.2 (semver) cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* |
Date Public
2026-10-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119741",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:43:41.930734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:44:12.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/RsyncProject/rsync",
"product": "rsync",
"repo": "https://github.com/RsyncProject/rsync",
"vendor": "RsyncProject",
"versions": [
{
"lessThanOrEqual": "3.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.5.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.5.2",
"versionEndIncluding": "3.5.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Samuel Henrique (samueloph)"
},
{
"lang": "en",
"type": "reporter",
"value": "Dianne Skoll (dfskoll)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Omar Elsayed (seks99x)"
}
],
"datePublic": "2026-10-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender\u0027s hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T14:15:55.669Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fixed Release Tag",
"tags": [
"release-notes"
],
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.2"
},
{
"name": "Pull Request #1132",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/RsyncProject/rsync/pull/1132"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py"
},
{
"name": "VulnCheck Advisory: rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions"
}
],
"title": "rsync \u003c 3.5.2 Denial of Service via hash_search() Checksum Collisions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119741",
"datePublished": "2026-11-03T15:26:27.533Z",
"dateReserved": "2026-10-30T15:31:52.079Z",
"dateUpdated": "2026-11-04T14:15:55.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119197 (GCVE-0-2026-119197)
Vulnerability from cvelistv5 – Published: 2026-10-29 19:48 – Updated: 2026-10-30 16:08
VLAI
EPSS
VEX
Title
pyasn1: Quadratic-complexity denial of service in binary REAL decoding
Summary
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:47 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pyasn1/pyasn1/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pyasn1/pyasn1/pull/132 | x_refsource_MISC |
| https://github.com/pyasn1/pyasn1/commit/ce3ec3390… | x_refsource_MISC |
| https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:47:11.257992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:08:50.120Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pyasn1",
"vendor": "pyasn1",
"versions": [
{
"status": "affected",
"version": "\u003c 0.6.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T19:48:52.470Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx"
},
{
"name": "https://github.com/pyasn1/pyasn1/pull/132",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/pull/132"
},
{
"name": "https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4"
},
{
"name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"
}
],
"source": {
"advisory": "GHSA-mm57-4v3p-rchx",
"discovery": "UNKNOWN"
},
"title": "pyasn1: Quadratic-complexity denial of service in binary REAL decoding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119197",
"datePublished": "2026-10-29T19:48:52.470Z",
"dateReserved": "2026-10-29T16:04:48.728Z",
"dateUpdated": "2026-10-30T16:08:50.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119196 (GCVE-0-2026-119196)
Vulnerability from cvelistv5 – Published: 2026-10-29 19:44 – Updated: 2026-11-04 01:40
VLAI
EPSS
VEX
Title
pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding
Summary
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:40 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pyasn1/pyasn1/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pyasn1/pyasn1/pull/132 | x_refsource_MISC |
| https://github.com/pyasn1/pyasn1/commit/73ba7b043… | x_refsource_MISC |
| https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119196",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:40:25.017112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:40:46.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pyasn1",
"vendor": "pyasn1",
"versions": [
{
"status": "affected",
"version": "\u003c 0.6.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T19:44:46.031Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"
},
{
"name": "https://github.com/pyasn1/pyasn1/pull/132",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/pull/132"
},
{
"name": "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c"
},
{
"name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"
}
],
"source": {
"advisory": "GHSA-2qm8-x737-gmw5",
"discovery": "UNKNOWN"
},
"title": "pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119196",
"datePublished": "2026-10-29T19:44:46.031Z",
"dateReserved": "2026-10-29T16:04:48.728Z",
"dateUpdated": "2026-11-04T01:40:46.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119195 (GCVE-0-2026-119195)
Vulnerability from cvelistv5 – Published: 2026-10-29 19:41 – Updated: 2026-10-29 20:26
VLAI
EPSS
VEX
Title
pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding
Summary
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:25 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pyasn1/pyasn1/security/advisor… | x_refsource_CONFIRM |
| https://github.com/pyasn1/pyasn1/pull/132 | x_refsource_MISC |
| https://github.com/pyasn1/pyasn1/commit/4ce00797c… | x_refsource_MISC |
| https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119195",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:25:48.864403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:26:31.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pyasn1",
"vendor": "pyasn1",
"versions": [
{
"status": "affected",
"version": "\u003c 0.6.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T19:41:37.352Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39"
},
{
"name": "https://github.com/pyasn1/pyasn1/pull/132",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/pull/132"
},
{
"name": "https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9"
},
{
"name": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"
}
],
"source": {
"advisory": "GHSA-9m75-vc3g-4x39",
"discovery": "UNKNOWN"
},
"title": "pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119195",
"datePublished": "2026-10-29T19:41:37.352Z",
"dateReserved": "2026-10-29T16:04:48.728Z",
"dateUpdated": "2026-10-29T20:26:31.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.