HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
CVE-2026-84382
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_d
#cwe-409
共收录 169 条相关情报。
← 返回所有主题Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with w...
CVE-2026-78594
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Exces
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams manag...
CVE-2026-72628
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service ...
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer()
pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb
CVE-2026-82864
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer()
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An ...
CVE-2026-58107
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib d
Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun
CVE-2026-58107
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib d
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap m...
CVE-2026-59274
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an at
http4s has HTTP/2 Denial of Service with Ember Backend
CVE-2026-54556
### Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copi...
CVE-2026-80189
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in int
LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction
CVE-2026-80189
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in int
gRPC Erlang package has unbounded gzip decompression (decompression bomb)
CVE-2026-53430
### Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compr
exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can uplo...
CVE-2026-78206
CVE-2026-78206 影响 exceljs-hardened 库 5.0.0 之前的版本。该库用于解析和生成 Excel xlsx 文件。漏洞成因在于解析 xlsx 存档时，程序会毫无限制地将所有条目解压到内存中，未对单个条目大小、
WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression functio...
CVE-2026-53524
CVE-2026-53524 影响 WeeChat（Wee Enhanced Environment for Chat）4.3.0 至 4.9.0 版本。WeeChat 是一款免费聊天客户端，其 relay 模块在实现 WebSocket
Tanium addressed a compression bomb vulnerability in Threat Response.
CVE-2026-75476
Tanium addressed a compression bomb vulnerability in Threat Response.
Tanium addressed a compression bomb vulnerability in Findings.
CVE-2026-11617
Tanium addressed a compression bomb vulnerability in Findings.
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() wi...
CVE-2026-61690
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipA
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a ...
CVE-2026-75936
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 migh
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/ta...
CVE-2026-19671
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompress
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust mem...
CVE-2026-74046
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.