By weakness (CWE)

CWE-407: related vulnerabilities

CVEs classified under CWE-407. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-41850HIGH 7.5

  Spring Framework contains a vulnerability in how it evaluates user-supplied SpEL (Spring Expression Language) expressions. An attacker can craft a malicious expression that forces the application to consume excessive CPU or memory during processing, causing the application to slow down or become completely unavailable. This only affects applications that directly evaluate untrusted SpEL input—not all Spring applications are vulnerable. The vulnerability impacts multiple recent versions of Spring Framework across the 5.3, 6.1, 6.2, and 7.0 release lines.

• CVE-2026-42504HIGH 7.5

  A vulnerability exists in MIME header parsing where specially crafted email headers containing multiple invalid encoded-words can trigger excessive CPU consumption, effectively causing a denial of service. An attacker can send a malicious email with a crafted header to impact system availability without requiring authentication or user interaction.

• CVE-2026-8889HIGH 7.5

  Securly's Chrome Extension version 3.0.7 relies on SHA-1 hashing—a cryptographically weak algorithm—to validate URLs against two critical blocklists: the Internet Watch Foundation (IWF) CSAM database and CIPA compliance rules. SHA-1's collision vulnerabilities mean an attacker could craft a malicious URL that hashes to the same value as a legitimate blocked URL, potentially bypassing content filtering controls that organizations depend on for legal compliance and child safety.

• CVE-2026-8594MEDIUM 6.2

  Text::LineFold, a Perl module for handling line breaks in text, contains a bug that causes it to duplicate output when processing strings with certain special break characters (like vertical tabs and form feeds). The module splits input by these characters but then applies its line-breaking logic to the entire original string instead of just the individual segments, resulting in unnecessary duplication. While primarily a logic error, this can cause excessive memory and CPU consumption if exploited, potentially leading to denial of service on systems processing untrusted text input.

• CVE-2026-11312LOW 3.3

  A flaw in ByteDance's InfiniStore library (versions up to 0.2.33) allows a local user to trigger inefficient algorithmic behavior in the key-value map purge function. An attacker with local access can manipulate input to the purge_kv_map routine, causing the function to consume excessive CPU or processing time. The vulnerability requires local system access and valid user privileges, limiting its scope, but public exploit code now exists.