Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detecti...

CVE-2026-105747

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

Praxis affected by HTTP/2 Bomb

### Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have

历史摘要 · 未重新核验 · GitHub Advisory

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings. This issue...

CVE-2026-66054

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) v

历史摘要 · 未重新核验 · NVD

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are rec...

CVE-2026-94637

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This iss

历史摘要 · 未重新核验 · NVD

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerab...

CVE-2026-94636

Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Im

历史摘要 · 未重新核验 · NVD

devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into

历史摘要 · 未重新核验 · GitHub Advisory

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a ...

CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows

历史摘要 · 未重新核验 · NVD

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows

历史摘要 · 未重新核验 · OSV.dev

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a...

CVE-2026-86104

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthent

历史摘要 · 未重新核验 · NVD

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

**Affected package:** adm-zip (npm) **Affected version:** 0.6.0 ## Summary The fix shipped for CVE-2026-39244 (`method

历史摘要 · 未重新核验 · GitHub Advisory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a deco...

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client

历史摘要 · 未重新核验 · NVD

Nicotine+: Decompression of peer messages can exhaust available memory

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client

历史摘要 · 未重新核验 · OSV.dev

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enablin...

CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy We

历史摘要 · 未重新核验 · NVD

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

CVE-2026-77528

### Summary Autobahn Python enforces `maxMessagePayloadSize` against the compressed WebSocket frame length before permes

历史摘要 · 未重新核验 · GitHub Advisory

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websoc...

CVE-2026-83599

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates per

历史摘要 · 未重新核验 · NVD

Netdata: WebSocket Decompression Bomb

CVE-2026-83599

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates per

历史摘要 · 未重新核验 · OSV.dev

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nest...

CVE-2026-77620

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decom

历史摘要 · 未重新核验 · NVD

Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

CVE-2026-77620

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decom

历史摘要 · 未重新核验 · OSV.dev

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompress...

CVE-2026-63452

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

历史摘要 · 未重新核验 · NVD

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely...

CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, We

历史摘要 · 未重新核验 · NVD