CVE-2026-69304

CVE-2026-69304 is a Denial of Service (DoS) vulnerability in ASP.NET Core caused by improper handling of highly compressed data, also referred to as data amplification . An unauthorized attacker over a network can trigger a denial of service without requiring prior authentication or user interact...

CVE-2026-69304

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-69304

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

ASP.NET Core Denial of Service Vulnerability

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

PT-2026-87350

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Server.IISIntegration versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.AspNetCore.Server.IISIntegration versions 10.0.0 through 10.0.11 Microsoft.AspNetCore.Server.IISIntegration versions 9.0.0 through 9.0.19...

CVE-2026-69304: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

CVE-2026-69304

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-44432 DESCRIPTION: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the...

CVE-2026-85786: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

Security Bulletin: MongoDB Enterprised Advanced affected by: Data Amplification, Uncontrolled Resource Consumption (CVE-2025-58057, CVE-2026-42583)

Summary There are vulnerabilities in netty-codec-4.1.132.Final.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-58057, CVE-2026-42583. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-58057 DESCRIPTION: Netty is an asynchronous event-driven network...

CVE-2026-82520: Improper Handling of Highly Compressed Data (Data Amplification)

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...

CVE-2026-78594: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

CVE-2026-84382: Improper Handling of Highly Compressed Data (Data Amplification)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)

Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map...

CVE-2026-72628: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing,...

Data Amplification

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Data Amplification in the handleCompressedPacket function of lib/compressedprotocol.js, which calls zlib.inflatebody, ... without a maxOutputLength option...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF002 Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0...

CVE-2026-82864: Improper Handling of Highly Compressed Data (Data Amplification)

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache Thrift

Summary IBM SPSS Modeler is affected by vulnerabilities in Apache Thrift. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-43871 DESCRIPTION: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java...

CVE-2026-58107: Improper Handling of Highly Compressed Data (Data Amplification)

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...