golang.org/x/net v0.62.0 fixes HTML text-node complexity flaw
The html package change targets quadratic work while coalescing adjacent text nodes in addText.
Stories per day · 30 days
1 RSS
6 stories, newest first · one card per story
Stories tagged #algorithmic-complexity
Black-Box HashDoS: Attacking Hash Tables Without Knowing the Hash Function
A new black-box HashDoS technique slows hash-table lookups to linear time without knowing the hash function, including Rust's standard map.
USN-8808-1: SQL parse vulnerabilities
Ubuntu warned that SQL parse complexity flaws can exhaust CPU via deeply nested SQL statements.
CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
Apache Neethi before 3.2.4 exponentially re-expands repeated policy references during normalization, enabling CPU and memory exhaustion attacks.
rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback
rosbridge_library's Protocol.incoming() has quadratic CPU cost in its JSON fallback, enabling denial of service via crafted messages.
graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule
Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.