CWEweakness

CWE-1176 Inefficient CPU Computation

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.

Common consequences

• Availability: Reduce Performance, DoS: Resource Consumption (CPU) — This issue can make the product perform more slowly, possibly in ways that are noticeable to the users. If an attacker can influence the amount of computation that must be performed, e.g. by triggering worst-case complexity, then this performance problem might introduce a vulnerability.

Observed examples

• CVE-2022-37734: Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)

Related

Observed example · CVE (1)

  • CVE-2022-37734 graphql-java before19.0 is vulnerable to Denial of Service. vulnerability

Child of · CWE (1)

  • CWE-405 Asymmetric Resource Consumption (Amplification) weakness

Referenced by CVE · weakness (3)

  • CVE-2026-18503 Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when… vulnerability
  • CVE-2025-46153 PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU… vulnerability
  • CVE-2024-23323 Envoy is a high-performance edge/middle/service proxy. vulnerability

Referenced by CWE · child of (5)

  • CWE-1042 Static Member Data Element outside of a Singleton Class Element weakness
  • CWE-1046 Creation of Immutable Text Using String Concatenation weakness
  • CWE-1049 Excessive Data Query Operations in a Large Data Table weakness
  • CWE-1063 Creation of Class Instance within a Static Code Block weakness
  • CWE-1067 Excessive Execution of Sequential Searches of Data Resource weakness