Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation
CVE-2026-77528
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, We
#cwe-409
共收录 169 条相关情报。
← 返回所有主题libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do...
CVE-2026-84384
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata
libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS
CVE-2026-84384
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count...
CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
CVE-2026-81875
### Summary `SHCParser` inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automat...
CVE-2026-85721
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
CVE-2026-59193
### Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archi
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicati...
CVE-2026-70469
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests th
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/...
CVE-2026-81875
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to versio
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP...
CVE-2026-92000
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncom
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives ...
CVE-2026-92000
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncom
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire inco...
CVE-2026-44163
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decom...
CVE-2026-46387
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
Suricata http2: decompression bomb can cause denial of service in Suricata
CVE-2026-46387
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-69304
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that...
CVE-2026-85786
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a den
Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
CVE-2026-85786
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a den
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes i...
CVE-2026-82520
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
CVE-2026-61690
## Summary `ZipArchiver::extract()` lacks limits on uncompressed size, file count, and nesting depth, creating a distinc
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd ...
CVE-2026-84382
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_d