Monthly
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invoke a paper-trailed Ash action with an accepted array attribute to exhaust backend CPU and memory. Versions 0.1.1 through 0.6.x are affected; the root cause is an O(n³) list accumulation pattern in `AshPaperTrail.ChangeBuilders.FullDiff.ListChange` where unbounded action input directly drives allocation. No public exploit has been identified and the issue is not in CISA KEV, but no rate-limiting or length check guards the vulnerable path, making the attack trivially reproducible by any user with action access.
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.
CPU exhaustion via algorithmic complexity in Apache APISIX 3.17.0 allows unauthenticated remote attackers to pin a gateway worker process at 100% CPU using a single small HTTP request targeting routes protected by the graphql-limit-count plugin. The CVSS 4.0 score of 8.7 reflects the high availability impact and trivial exploitation requirements - no authentication, no complexity, no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the minimal attack payload described makes this class of vulnerability straightforward to weaponize once the affected plugin is known to be in use.
CPU exhaustion in libsoup's HTTP Range header processing affects any SoupServer deployment carrying the CVE-2025-32907 fix but not MR !550. Supplying a Range header with approximately 25,000 repeated satisfiable byte ranges triggers an O(N²) coalescing loop - each g_array_remove_index() call induces an O(N) memmove on GArray - blocking the server's event loop for roughly 90 ms per request from a single unauthenticated client. The description explicitly rules out memory corruption and information disclosure; this is a pure availability issue with no public exploit identified at time of analysis.
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS AC:H rating reflects the two-condition prerequisite, moderating the net risk score to 5.9 Medium despite the unauthenticated network vector.
Denial-of-service via quadratic CPU exhaustion in Netty's SniHandler affects all Netty deployments prior to 4.1.137.Final and 4.2.17.Final that use the default SniHandler constructors for TLS termination. An unauthenticated remote peer can fragment a large TLS ClientHello across thousands of small records, causing SslClientHelloHandler#decode to recopy all previously received bytes on every record arrival - O(N²) work that stalls the Netty event loop and denies TLS service to all concurrent clients. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified, but the low attack complexity and zero-authentication requirement make this a credible threat for any internet-exposed Netty TLS endpoint.
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute processing function, enabling remote unauthenticated attackers to exhaust server CPU with a compact, well-formed XML document. The flaw-closely related to CVE-2026-45186 fixed in Expat 2.8.1-requires no authentication, no external entity resolution, and no non-default parser options to trigger, and is significantly amplified when XML payloads are compression-wrapped. No public exploit code has been identified at time of analysis, but the attack algorithm is fully derivable from the public PR diff and vulnerability description, making independent weaponization low-effort.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
Quadratic time complexity in Go's standard library net/url package exposes Go-based web services to denial of service through crafted URL paths. Applications running on Go versions before 1.26.6 or 1.25.13 that resolve attacker-supplied relative URL paths containing many parent-directory segments are affected, with CPU and memory consumption growing quadratically with input size. No active exploitation or public proof-of-concept has been identified at time of analysis; the fix is confirmed available in Go 1.26.6 and Go 1.25.13, released August 13, 2026.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invoke a paper-trailed Ash action with an accepted array attribute to exhaust backend CPU and memory. Versions 0.1.1 through 0.6.x are affected; the root cause is an O(n³) list accumulation pattern in `AshPaperTrail.ChangeBuilders.FullDiff.ListChange` where unbounded action input directly drives allocation. No public exploit has been identified and the issue is not in CISA KEV, but no rate-limiting or length check guards the vulnerable path, making the attack trivially reproducible by any user with action access.
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. Any service that passes untrusted text through PorterStemmer.stem() without input length validation is vulnerable; a ~20-50 KB payload of repeated 'y' characters followed by a matching suffix such as 'ness' is sufficient to trigger the condition. No public exploit code is identified at time of analysis, but the attack primitive is trivially constructable from the public description. Fix is available in NLTK 3.10.3.
CPU exhaustion via algorithmic complexity in Apache APISIX 3.17.0 allows unauthenticated remote attackers to pin a gateway worker process at 100% CPU using a single small HTTP request targeting routes protected by the graphql-limit-count plugin. The CVSS 4.0 score of 8.7 reflects the high availability impact and trivial exploitation requirements - no authentication, no complexity, no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the minimal attack payload described makes this class of vulnerability straightforward to weaponize once the affected plugin is known to be in use.
CPU exhaustion in libsoup's HTTP Range header processing affects any SoupServer deployment carrying the CVE-2025-32907 fix but not MR !550. Supplying a Range header with approximately 25,000 repeated satisfiable byte ranges triggers an O(N²) coalescing loop - each g_array_remove_index() call induces an O(N) memmove on GArray - blocking the server's event loop for roughly 90 ms per request from a single unauthenticated client. The description explicitly rules out memory corruption and information disclosure; this is a pure availability issue with no public exploit identified at time of analysis.
Unauthenticated ReDoS in Splunk Connect for Kafka below version 2.2.7 allows a network-accessible attacker to permanently block a Kafka Connect worker thread by submitting a pathological regular expression via the Kafka Connect REST API, which - when triggered by attacker-supplied or coincident matching event data during timestamp extraction - causes the regex engine to backtrack catastrophically without bound. The practical result is complete stoppage of event delivery for the targeted connector, constituting a targeted denial-of-service against Splunk data ingestion pipelines. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS AC:H rating reflects the two-condition prerequisite, moderating the net risk score to 5.9 Medium despite the unauthenticated network vector.
Denial-of-service via quadratic CPU exhaustion in Netty's SniHandler affects all Netty deployments prior to 4.1.137.Final and 4.2.17.Final that use the default SniHandler constructors for TLS termination. An unauthenticated remote peer can fragment a large TLS ClientHello across thousands of small records, causing SslClientHelloHandler#decode to recopy all previously received bytes on every record arrival - O(N²) work that stalls the Netty event loop and denies TLS service to all concurrent clients. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified, but the low attack complexity and zero-authentication requirement make this a credible threat for any internet-exposed Netty TLS endpoint.
Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute processing function, enabling remote unauthenticated attackers to exhaust server CPU with a compact, well-formed XML document. The flaw-closely related to CVE-2026-45186 fixed in Expat 2.8.1-requires no authentication, no external entity resolution, and no non-default parser options to trigger, and is significantly amplified when XML payloads are compression-wrapped. No public exploit code has been identified at time of analysis, but the attack algorithm is fully derivable from the public PR diff and vulnerability description, making independent weaponization low-effort.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
Quadratic time complexity in Go's standard library net/url package exposes Go-based web services to denial of service through crafted URL paths. Applications running on Go versions before 1.26.6 or 1.25.13 that resolve attacker-supplied relative URL paths containing many parent-directory segments are affected, with CPU and memory consumption growing quadratically with input size. No active exploitation or public proof-of-concept has been identified at time of analysis; the fix is confirmed available in Go 1.26.6 and Go 1.25.13, released August 13, 2026.