CVE-2026-45822
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SamVerschueren | decode-uri-component | 0.1.0< 0.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45822
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SamVerschueren decode-uri-component 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SamVerschueren decode-uri-component是SamVerschueren个人开发者的一个解码URI组件的工具。 SamVerschueren decode-uri-component 0.4.1及之前版本存在资源管理错误漏洞，该漏洞源于decode()函数对'%'分隔输入的处理不当，导致解析时间超线性增长，可能造成CPU大量消耗和事件循环阻塞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SamVerschueren | decode-uri-component | 0.1.0 ~ 0.5.0 | - |
II. Public POCs for CVE-2026-45822
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45822
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45822 (1)
Vendor Pages for CVE-2026-45822 (1)
Other References for CVE-2026-45822 (1)
IV. Related Vulnerabilities
Same weakness: CWE-400
- CVE-2026-10668
Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuM - CVE-2026-55781
NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS pa - CVE-2026-55782
NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAss - CVE-2026-59161
Excelize: Streaming GetRows row-bound bypass causes attacker - CVE-2026-8609
Pre-authentication denial of service via the OAuth login rou
V. Comments for CVE-2026-45822
No comments yet