Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 323

Export CSV
CVE-2026-126300

NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Nltk
Products
Nltk
CVE-2026-126301

NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Nltk
Products
Nltk
CVE-2026-126401

Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Fleetdm
Products
Fleet
CVE-2026-128237

Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding

Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows remote attackers to exhaust CPU by supplying oversized OID arcs. Attackers can send ASN.1/BER data with many base-128 continuation bytes to cause quadratic CPU consumption or an uncaught ValueError crash on Python 3.11+.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
Scapy
Products
Scapy
CVE-2026-126623

Inefficient Algorithmic Complexity in hMailServer

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574, in which reading a JSON object searched the member names already read for each new name, by keeping the names in a hash set; the set uses the standard library's hash, which takes no secret, so member names chosen to fall in one bucket of it still cost time growing with the square of their number. Against the released reader, one such object of 16 MB took about 5 seconds to read in the Linux build, and one of under 6 MB about 23 seconds in the Windows build, where objects of the same sizes with other names took under a tenth of a second. A remote unauthenticated attacker reaches the reader by mailing such an object as a TLS-RPT report, up to 16 MB once decompressed, to a hosted domain's report mailbox, where an administrator has set one; it is read on a mail delivery thread (ten by default), and those threads deliver all mail, local and outbound, so a stream of such reports stops all delivery for as long as it continues. It is also reached without an account through the reply to a password-protected message, with the message's link alone, where the REST API is on (it is off by default) and a public base URL for such links is set; and by any account through the webmail's routes granted 16 MB, and by an application's API key through the send API. Each such request holds one of the REST API's four worker threads, in the process that also serves SMTP, IMAP and POP3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver
CVE-2026-127056

PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Mholt
Products
Papaparse
CVE-2026-126189

Soup Sieve: Quadratic-time denial of service when matching `:has()`

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child, causing quadratic matching on deeply nested or wide attacker-influenced HTML or XML. Applications using ordinary fixed selectors through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while applications that process only trusted documents are not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.1.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Facelessuser
Products
Soupsieve
CVE-2026-126190

Soup Sieve: Polynomial-time denial of service in the descendant combinator

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the same ancestors while matching descendant combinators, and each additional descendant combinator raises the polynomial degree of the work on deeply nested attacker-influenced HTML or XML. Applications using selectors such as section div div through select(), select_one(), or Beautiful Soup CSS APIs against untrusted documents can have a worker occupied for seconds or minutes, while trusted-only document processing is not affected. Selectors compiled with NOCACHE continue to use the old uncached behavior. This issue is fixed in version 4.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Facelessuser
Products
Soupsieve
CVE-2026-126192

Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when the right-hand side is absent, producing quadratic work on attacker-controlled HTML. Applications that evaluate a fixed selector such as div:has(a ~ b) over untrusted markup can have a worker occupied for minutes by a small document, while the adjacent sibling form and trusted-only document processing are not affected in the same way. This issue is fixed in version 2.10.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed
Vendors
Facelessuser
Products
Soupsieve
CVE-2026-126351

Addressable: Denial of service in URI path normalization

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-114369

Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework

Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module

CVSS 4.0 · 2.7 Low EPSS n/a KEV · Not listed
Vendors
Qt
Products
Qt Qt Framework Qtwebsockets
CVE-2026-124683

Inefficient Algorithmic Complexity Causes Denial of Service in Eclipse Langium

Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer. When producing DEDENT tokens, the token builder recomputes line numbers by re-scanning the entire preceding document text. A document whose indentation changes on most lines then takes quadratic time to tokenize. Because tokenization is synchronous, a crafted document of a few hundred kilobytes can block the Node.js event loop for tens of seconds. That causes a DoS for every user served by the same process. Languages built with the DefaultLexer and DefaultTokenBuilder are unaffected.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Eclipse Langium
CVE-2026-124016

postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine

postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Postalsys
Products
Postal-mime
CVE-2026-118036

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Document Processing Libraries
CVE-2026-118035

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Document Processing Libraries
CVE-2026-118153

Microsoft Exchange Server Denial of Service Vulnerability

Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Microsoft
Products
Exchange Server Se