CVE-2026-69304

A flaw was found in ASP.NET Core. This vulnerability arises from the improper handling of highly compressed data, a technique referred to as data amplification. An unauthorized attacker can exploit this weakness remotely over a network. Successful exploitation leads to a denial of service,...

Linux Distros Unpatched Vulnerability : CVE-2026-96618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space...

CVE-2026-105274

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

UBUNTU-CVE-2026-105274

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

Linux Distros Unpatched Vulnerability : CVE-2026-105274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering...

DEBIAN-CVE-2026-105274

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

EUVD-2026-97568

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

CVE-2026-105274

The hexpm hex_core library, along with vendored components in Hex (mix_hex_repo, mix_hex_api) and rebar3 (r3_hex_repo, r3_hex_api), is vulnerable to a Data Amplification (CWE-409) attack. The vulnerability exists because hex_core decompresses registry responses using zlib:gunzip/1 and decodes Erl...

EEF-CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi...

CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618

The hexpm hex package (versions 0.11.2 before 2.5.2) is vulnerable to a Data Amplification attack where an untrusted mirror can exhaust a machine's memory or disk space. The root cause is that Hex.HTTP.request/5 decompresses gzip responses without enforcing size limits, and package tarballs/docs ...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

EEF-CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configure...

EUVD-2026-97500

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-109398: Improper Handling of Highly Compressed Data (Data Amplification)

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps,...

CVE-2026-96618: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

PT-2026-110652

Name of the Vulnerable Software and Affected Versions hexpm hex versions 0.11.2 through 2.5.1 Description An improper handling of highly compressed data, known as data amplification, allows an untrusted package mirror to exhaust the memory or disk space of a machine running mix deps.get, mix...