CWE-407Inefficient Algorithmic Complexity

Abstraction: Class · CVEs in our corpus: 141

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Last updated: 21 August 2026 14:15 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SC-5 Denial-of-service Protection
ID.RA-01
PR.PS-06
SC-5 Denial-of-service Protection

Detect

Catch it (CSF Detect / Respond)

DE.CM-09

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V1.2.9

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SC-5`	Denial-of-service Protection	SC	Addresses inefficient algorithms whose complexity can be exploited for DoS.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2020-27223`	7.0	5.2	0.7795	2021-02-26
`CVE-2022-36021`	7.0	5.5	0.5971	2023-03-01
`CVE-2016-10396`	6.3	7.5	0.0293	2017-07-06
`CVE-2018-12558`	6.3	7.5	0.0265	2018-06-20
`CVE-2021-33582`	6.3	7.5	0.0307	2021-09-01
`CVE-2022-45061`	6.3	7.5	0.0252	2022-11-09
`CVE-2023-46136`	6.3	8.0	0.0107	2023-10-25
`CVE-2024-43483`	6.3	7.5	0.0287	2024-10-08
`CVE-2024-43484`	6.3	7.5	0.0294	2024-10-08
`CVE-2024-43485`	6.3	7.5	0.0305	2024-10-08
`CVE-2019-19331`	6.2	7.5	0.0217	2019-12-16
`CVE-2022-39209`	6.2	7.5	0.0171	2022-09-15
`CVE-2022-40188`	6.2	7.5	0.0158	2022-09-23
`CVE-2025-64458`	6.2	7.5	0.0190	2025-11-05
`CVE-2025-64460`	6.2	7.5	0.0212	2025-12-02
`CVE-2024-21909`	6.1	7.5	0.0106	2024-01-03
`CVE-2023-4408`	6.1	7.5	0.0134	2024-02-13
`CVE-2026-55968`	6.1	7.5	0.0110	2026-07-27
`CVE-2017-11343`	6.0	7.5	0.0093	2017-07-17
`CVE-2022-22153`	6.0	7.5	0.0093	2022-01-19
`CVE-2023-38285`	6.0	7.5	0.0090	2023-07-26
`CVE-2024-23684`	6.0	7.5	0.0091	2024-01-19
`CVE-2024-8233`	6.0	7.5	0.0076	2024-12-12
`CVE-2024-9631`	6.0	7.5	0.0072	2025-02-05
`CVE-2025-27209`	6.0	7.5	0.0077	2025-07-18