CWE-407 Inefficient Algorithmic Complexity

containerd: Unpack DoS via repeated opaque whiteouts

Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

msgpack5: Quadratic parsing in the streaming decoder

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

devalue: Residual sparse-array CPU amplification in uneval

pypdf: Possible long runtimes with large amount of embedded files

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

fzf vulnerable to denial of service through quadratic HTTP request-body accumulation

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict