CWE-407 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-407 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-69651Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne…1.1%높음7.5CVE-2026-96958Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne…1.1%높음7.5CVE-2026-70196Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service o…0.8%보통5.9CVE-2026-84008Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne…0.8%높음7.5CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…0.7%보통5.9CVE-2026-69184c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward…0.7%높음7.5CVE-2026-63446Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…0.7%높음7.5CVE-2026-113436Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allo…0.6%높음8.7
전체 목록
120건
CVE-2026-108529Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unau…0.6%높음8.7
CVE-2026-75507GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1…0.6%높음7.5
CVE-2026-87081Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an over…0.6%높음7.5
CVE-2026-87079Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decod…0.6%높음7.5
CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.6%높음7.5
CVE-2026-71418Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.6%높음7.5
CVE-2026-111759markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially cra…0.6%높음7.5
CVE-2026-61814Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a singl…0.6%높음7.5
CVE-2026-119195pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY dec…0.5%높음7.5
CVE-2026-114138Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accep…0.5%높음7.5
CVE-2026-16762An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause dispropor…0.5%높음8.7
CVE-2026-96640Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfPar…0.5%높음8.2
CVE-2026-82760Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthenticated a…0.5%높음8.2
CVE-2026-92091A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate val…0.5%보통5.9
CVE-2026-116795RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.…0.5%높음7.5
CVE-2026-82729Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CP…0.5%보통6.3
CVE-2026-90776Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparse…0.5%높음8.7
CVE-2026-113729Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicaliza…0.5%높음7.5
CVE-2026-118694python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust …0.5%높음8.7
CVE-2026-19630In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional proces…0.4%높음7.5
CVE-2026-111758markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link r…0.5%높음7.5
CVE-2026-85494Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, M…0.5%높음8.7
CVE-2026-115352Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows un…0.4%높음8.7
CVE-2026-96643Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slice…0.4%높음7.1
CVE-2026-119197pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one…0.4%높음7.5
CVE-2026-119194pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores eve…0.4%높음7.5
CVE-2026-119196pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shift…0.4%높음7.5
CVE-2019-25781Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing tha…0.4%높음8.7
CVE-2026-62160Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/langua…0.4%높음8.7
CVE-2026-44639NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqt…0.4%낮음3.7
CVE-2026-107574Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthe…0.4%높음7.5
CVE-2026-107576Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMa…0.4%높음7.5
CVE-2026-115585pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeat…0.4%높음7.1
CVE-2026-115347Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allo…0.4%높음8.7
CVE-2026-96287Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thr…0.4%높음8.2
CVE-2026-96292Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift L…0.4%높음8.2
CVE-2026-94655Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apac…0.4%높음8.2
CVE-2026-94658Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thri…0.4%높음8.7
CVE-2026-94653Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thri…0.4%높음8.2
CVE-2026-19668A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a pa…0.4%보통5.3
CVE-2026-65634Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenti…0.4%높음8.2
CVE-2026-114141toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableAr…0.4%높음8.7
CVE-2026-113789pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that cau…0.4%보통6.0
CVE-2026-102461In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueIte…0.4%높음8.7
CVE-2026-92365A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functional…0.4%보통5.3
CVE-2026-116577Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header par…0.4%보통5.3
CVE-2026-118036In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infi…0.4%높음7.5
CVE-2026-104844PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior t…0.4%보통5.9
CVE-2026-107297msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder rep…0.4%보통5.9
CVE-2026-107575Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5…0.4%보통5.3
CVE-2026-87822t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.from…0.4%높음8.7
CVE-2026-116587Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, inc…0.4%높음7.5
CVE-2026-107378CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-cont…0.4%높음8.7
CVE-2026-114143toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rej…0.4%높음8.7
CVE-2026-84429An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.htt…0.4%보통6.9
CVE-2026-112891Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a G…0.4%보통6.9
CVE-2026-112401Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing G…0.4%보통6.9
CVE-2026-117540svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that…0.4%높음8.7
CVE-2026-116872Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::nor…0.4%높음8.7
CVE-2026-92987roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without…0.4%높음8.7
CVE-2026-85446MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new …0.4%높음8.7
CVE-2026-111766markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is ena…0.4%낮음3.7
CVE-2026-101021MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart …0.3%높음8.7
CVE-2026-107579Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3…0.3%높음7.5
CVE-2023-54395PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket proc…0.3%보통5.3
CVE-2026-102999pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedd…0.3%높음8.7
CVE-2026-102997pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially…0.3%높음8.7
CVE-2026-102994pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-ob…0.3%높음8.7
CVE-2026-118664decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriCompon…0.3%높음8.2
CVE-2026-116133HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body …0.3%미평가
CVE-2026-42772Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arri…0.3%보통5.3
CVE-2026-67419RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a …0.3%높음7.1
CVE-2026-87721Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.…0.3%높음8.7
CVE-2026-49250Conform, a type-safe form validation library, allows the parsing of nested objects in the form of object.prope…0.3%높음8.7
CVE-2026-118035In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inef…0.3%높음7.5
CVE-2026-104426Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value…0.3%높음8.2
CVE-2026-86434league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability i…0.3%높음8.7
CVE-2026-86433commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extens…0.3%높음8.7
CVE-2026-86429The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic pa…0.3%높음8.7
CVE-2026-86430league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code bloc…0.3%높음8.7
CVE-2026-102277The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21…0.3%보통5.3
CVE-2026-112894Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object…0.3%높음8.7
CVE-2024-58382league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing…0.3%높음8.7
CVE-2026-86428commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtens…0.3%높음8.7
CVE-2026-86435commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extensio…0.3%높음8.7
CVE-2026-107287Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.…0.3%보통6.5
CVE-2026-100700nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback re…0.3%높음8.7
CVE-2026-76271In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the …0.3%보통6.5
CVE-2026-89314`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validati…0.3%보통6.9
CVE-2026-103604Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUt…0.3%높음8.7
CVE-2026-107583Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailSer…0.3%보통6.5
CVE-2026-107582Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22…0.3%보통6.5
CVE-2026-107580Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6…0.3%보통6.5
CVE-2026-109348Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust…0.2%보통5.3
CVE-2026-107581Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in …0.2%보통6.5
CVE-2026-65631Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exh…0.2%보통6.9
CVE-2026-86349Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit th…0.2%보통4.3
CVE-2026-12882Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Ma…0.2%보통4.3
CVE-2026-95838containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer …0.2%보통4.6
CVE-2026-87768DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. _no…0.2%미평가
CVE-2026-110755Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per recor…0.2%미평가
CVE-2026-114129stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footpr…0.2%보통6.2
CVE-2026-116267MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncat…0.2%미평가
CVE-2026-116270MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimew…0.2%미평가
CVE-2026-110688Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining…0.2%미평가
CVE-2026-110260OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAn…0.2%보통6.8
CVE-2026-110270OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInliner…0.2%보통6.8
CVE-2026-110261OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by sup…0.2%보통6.8
CVE-2026-104182stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footpr…0.1%보통6.2
CVE-2026-77474destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI…0.1%높음7.1
CVE-2026-71429stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footpr…0.1%보통6.2
CVE-2026-115319fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents t…0.1%낮음2.0
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.