CVE-2026-77639

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

EUVD-2026-63648

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-77639

Tor before 0.4.9.9 is affected by a compression bomb bypass (TROVE-2026-022). An attacker can concatenate many gzip or zlib sub-streams , each individually just under the per-stream detection threshold, to circumvent the compression bomb check entirely. This results in a Denial of Service conditi...

CVE-2026-77639: Unprotected Alternate Channel

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

PT-2026-79149

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022...

CVE-2026-75476

Tanium addressed a compression bomb vulnerability in Threat Response...

CVE-2026-11617

Tanium addressed a compression bomb vulnerability in Findings...

EUVD-2026-63098

Tanium addressed a compression bomb vulnerability in Findings...

CVE-2026-11617

Tanium addressed a compression bomb vulnerability in its Findings component. The CVSS 3.1 score is 3.1 (LOW) , with a network attack vector, high complexity, low privileges required, and limited impact on availability only. No exploitation details or specific affected versions are provided in the...

CVE-2026-11617 Tanium addressed a compression bomb vulnerability in Findings.

Tanium addressed a compression bomb vulnerability in Findings...

EUVD-2026-63097

Tanium addressed a compression bomb vulnerability in Threat Response...

CVE-2026-75476 Tanium addressed a compression bomb vulnerability in Threat Response.

Tanium addressed a compression bomb vulnerability in Threat Response...

CVE-2026-75476

Tanium Threat Response is affected by a compression bomb vulnerability. A compression bomb (or zip bomb) allows an attacker to craft a small compressed file that expands to an extremely large size when decompressed, potentially exhausting system resources. The CVSS 3.1 score is 3.1 (LOW) , with a...

PT-2026-78716

Tanium addressed a compression bomb vulnerability in Threat Response...

CVE-2026-75476: Improper Handling of Highly Compressed Data (Data Amplification)

Tanium addressed a compression bomb vulnerability in Threat Response...

CVE-2026-11617: Improper Handling of Highly Compressed Data (Data Amplification)

Tanium addressed a compression bomb vulnerability in Findings...

PT-2026-78709

Tanium addressed a compression bomb vulnerability in Findings...

CVE-2026-19671

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

httpd: httpd: HTTP/2 Remote Denial of Service via compression bomb and Slowloris-style attack

A flaw was found in HTTP/2, affecting various web servers. A remote attacker can exploit this vulnerability by combining an HPACK compression bomb with a zero-byte flow-control window. This technique allows a small amount of data to expand into large memory allocations on the server, which are th...

RHEL 9 : mod_http2 (RHSA-2026:55930)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55930 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: modhttp2:...