undici vulnerable to Denial of Service via unbounded decompression of compressed responses

Impact The interceptors.decompress interceptor decompresses HTTP response bodies according to the untrusted Content-Encoding header. The number of decompression layers is capped at 5, but the total decompressed output size is not bounded and there is no option to limit it. A malicious or faulty...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

CVE-2026-28318-check

SolarWinds Serv-U Unauthenticated DoS: Safe Detection Script A safe, non-destructive detector for CVE-2026-28318 , an unauthenticated denial-of-service in SolarWinds Serv-U= 15.5.4.108. A single POST that carries Content-Encoding: deflate and a body feeds that body to an in-memory deflate...

Imperva_gzip_bypass

Imperva Web应用防火墙 WAF POST请求绕过 Imperva Cloud WAF 存在一个绕过漏洞，允许攻击者在发送恶意 HTTP POST 负载（如 log4j 漏洞利用、SQL 注入、命令执行、目录遍历、XXE 等）时规避 WAF 规则。 修复措施 Imperva 团队在收到报告后高度重视，并在短短几天内完成了全局修复，值得称赞。自 2021 年 12 月 22 日起，所有 Cloud WAF 客户已自动获得补丁。Imperva 团队合作愉快，显然拥有成熟、专业且能力强大的安全团队。 漏洞利用方法 向 HTTP POST 请求中添加 Content-Encoding:...

servu-cve-2026-28318-poc

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate" caída pre-autenticación Análisis de causa raíz + prueba de concepto de DoS. El aviso público clasifica esto como una denegación de servicio / consumo no controlado de recursos no autenticada. El análisis binario muestra que el defecto...

openSUSE 16: httpcomponents-client / httpcomponents-client-cache / etc (openSUSE-SU-2026:21894-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21894-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager...

Security Bulletin: HttpClient based on the classic i/o model fails to correctly release the underlying connection

Summary HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the...

Imperva_gzip_WAF_Bypass

Bypass de peticiones POST en Imperva Web Application Firewall WAF Imperva Cloud WAF era vulnerable a un bypass que permite a los atacantes evadir las reglas del WAF al enviar payloads HTTP POST maliciosos, como exploits de log4j, inyección SQL, ejecución de comandos, traversal de directorios, XXE...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

EUVD-2026-84182

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service...

BIT-NIFI-2026-70469 Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541

Zapros , a Python HTTP client, is vulnerable to denial of service in versions prior to 0.14.0 . The root cause is an unbounded chained Content-Encoding decompression chain : when an application requests content from an untrusted server (or follows a redirect to one), a malicious response containi...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

SUSE SLED15 / SLES15 Security Update : httpcomponents-client (SUSE-SU-2026:4028-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4028-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying...

CVE-2026-61541: Allocation of Resources Without Limits or Throttling

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

OPENSUSE-SU-2026:21894-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

CVE-2026-70469

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...