Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1325 CNY

100%
Buy Us a Coffee

CWE-407 (算法复杂性) — Vulnerability Class 61

61 vulnerabilities classified as CWE-407 (算法复杂性). AI Chinese analysis included.

CWE-407 represents a software weakness characterized by inefficient algorithmic complexity, specifically where worst-case computational performance is unexpectedly poor. This vulnerability is typically exploited by attackers who craft specific inputs designed to trigger these worst-case scenarios, thereby causing denial of service or significant system degradation. By forcing the application to consume excessive CPU resources or memory, adversaries can disrupt service availability for legitimate users. To mitigate this risk, developers must prioritize algorithmic efficiency during the design phase, selecting data structures and logic that maintain consistent performance regardless of input characteristics. Rigorous testing with edge cases and fuzzing helps identify potential bottlenecks, while code reviews ensure that complex operations do not introduce quadratic or exponential time complexities that could be weaponized against the system.

MITRE CWE Description
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Common Consequences (1)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
The typical consequence is CPU consumption, but memory consumption and consumption of other resources can also occur.
Examples (1)
This example attempts to check if an input string is a "sentence" [REF-1164].
var test_string = "Bad characters: $@#"; var bad_pattern  = /^(\w+\s?)*$/i; var result = test_string.search(bad_pattern);
Bad · JavaScript
var test_string = "Bad characters: $@#"; var good_pattern  = /^((?=(\w+))\2\s?)*$/i; var result = test_string.search(good_pattern);
Good · JavaScript
CVE IDTitleCVSSSeverityPublished
CVE-2019-19331 Knot Resolver 安全漏洞 — knot-resolver 7.5 -2019-12-16

Vulnerabilities classified as CWE-407 (算法复杂性) represent 61 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.