Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.
CWE-407 Class Incomplete
Inefficient Algorithmic Complexity
This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm…
Definition
What is CWE-407?
This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm into its slowest possible execution path, leading to severe performance degradation or denial of service.
At its core, this issue is about predictable resource exhaustion. Common examples include using algorithms with quadratic (O(n²)) or exponential complexity for tasks that handle user-controlled data size, like inefficient sorting or search algorithms on large, attacker-supplied inputs. When exploited, this can cause excessive CPU consumption, memory usage, or runtime delays, crippling the application's availability.
Developers can mitigate this by selecting algorithms with consistent, efficient complexity (like O(n log n) for sorting) and implementing safeguards. These include setting hard limits on input size, using timeouts for operations, and switching to more performant algorithms or data structures when processing thresholds are crossed. Always profile code with worst-case input scenarios during testing.
Real-world impact
Real-world CVEs caused by CWE-407
-
C++ library for image metadata has "quadratic complexity" issue with unnecessarily repetitive parsing each time an invalid character is encountered
-
Python has "quadratic complexity" issue when converting string to int with many digits in unexpected bases
-
server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
-
Perl-based email address parser has "quadratic complexity" issue via a string that does not contain a valid address
-
CPU consumption via inputs that cause many hash table collisions.
-
CPU consumption via inputs that cause many hash table collisions.
-
Product performs unnecessary processing before dropping an invalid packet.
-
CPU and memory consumption using many wildcards.
How attackers exploit it
Step-by-step attacker path
- 1
This example attempts to check if an input string is a "sentence" [REF-1164].
- 2
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
- 3
Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx.
Vulnerable code example
Vulnerable JavaScript
This example attempts to check if an input string is a "sentence" [REF-1164].
var test_string = "Bad characters: $@#";
var bad_pattern = /^(\w+\s?)*$/i;
var result = test_string.search(bad_pattern); Secure code example
Secure JavaScript
The regular expression has a vulnerable backtracking clause inside (\w+\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases. To fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \2 which prevents the backtracking. The modified example is:
var test_string = "Bad characters: $@#";
var good_pattern = /^((?=(\w+))\2\s?)*$/i;
var result = test_string.search(good_pattern); What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist
How to prevent CWE-407
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Detection signals
How to detect CWE-407
Run dynamic application security testing against the live endpoint.
Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.
Code review: flag any new code that handles input from this surface without using the validated framework helpers.
Plexicus auto-detects CWE-407 and opens a fix PR in under 60 seconds.
Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.
Frequently asked questions What is CWE-407?
How serious is CWE-407?
What languages or platforms are affected by CWE-407?
How can I prevent CWE-407?
How does Plexicus detect and fix CWE-407?
Where can I learn more about CWE-407?
Frequently asked questions
What is CWE-407?
This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm into its slowest possible execution path, leading to severe performance degradation or denial of service.
How serious is CWE-407?
MITRE rates the likelihood of exploit as Low — exploitation is uncommon, but the weakness should still be fixed when discovered.
What languages or platforms are affected by CWE-407?
MITRE has not specified affected platforms for this CWE — it can apply across most application stacks.
How can I prevent CWE-407?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
How does Plexicus detect and fix CWE-407?
Plexicus's SAST engine matches the data-flow signature for CWE-407 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-407?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/407.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Related weaknesses
Weaknesses related to CWE-407
CWE-405 Parent
Asymmetric Resource Consumption (Amplification)
This vulnerability occurs when a system allows an attacker to trigger a disproportionate amount of resource consumption—like CPU, memory,…
CWE-1050 Sibling
Excessive Platform Resource Consumption within a Loop
This vulnerability occurs when a loop contains code that repeatedly consumes critical system resources like file handles, database…
CWE-1072 Sibling
Data Resource Access without Use of Connection Pooling
This weakness occurs when an application creates a new database connection for every request instead of using a managed connection pool.…
CWE-1073 Sibling
Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
This weakness occurs when a client-side function or method makes an excessive number of individual data requests through a non-SQL data…
CWE-1084 Sibling
Invokable Control Element with Excessive File or Data Access Operations
This weakness occurs when a single function or method performs an excessive number of file or database operations, such as repeated reads,…
CWE-1089 Sibling
Large Data Table with Excessive Number of Indices
This weakness occurs when an application uses a database table with a very large number of rows and creates too many indexes on it,…
CWE-1094 Sibling
Excessive Index Range Scan for a Data Resource
This weakness occurs when a database query performs an index range scan that can access an unnecessarily large number of rows from a…
CWE-1176 Sibling
Inefficient CPU Computation
This weakness occurs when software uses inefficient algorithms or suboptimal CPU operations, performing unnecessary or overly complex…
CWE-406 Sibling
Insufficient Control of Network Message Volume (Network Amplification)
This vulnerability occurs when a system fails to properly limit the amount of network traffic it can generate in response to a request,…
Ready when you are
Don't Let Security
Weigh You Down.
Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.