690 matches found
CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory...
CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory...
PT-2026-25341
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0 Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the freerdp bitmap decompress planar function where an out-of-bounds read can occur when the SrcSize is 0. The...
PT-2026-25910
Name of the Vulnerable Software and Affected Versions lz4 flex versions 0.11.5 and below and 0.12.0 Description lz4 flex, a Rust implementation of LZ4 compression/decompression, contains a flaw where decompressing invalid LZ4 data can lead to information disclosure. Specifically, the library does...
PT-2026-29136
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2 Description FreeRDP is a free implementation of the Remote Desktop Protocol. The progressive decompress tile upgrade function detects a mismatch through progressive rfx quant cmp equal but only emits a warning,...
EUVD-2025-201573
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Bluetooth 6lowpan.c netdev has headerops, so it must set link-local header for RX skb, otherwise things crash, eg. with AFPACKET SOCKRAW Add missing skbresetmacheader...
GHSA-2XPW-W6GG-JR37 urllib3 streaming API improperly handles highly compressed data
Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP...
The vulnerability of the LZ4_decompress_fast() function in the lz4-java data compression library allows a hacker to cause a service failure and disclose confidential information.
The vulnerability of the LZ4decompressfast function in the lz4-java data compression library is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause service interruptions and expose sensitive information...
SUSE CVE-2025-64332
Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in version...
DEBIAN-CVE-2025-64332
Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in version...
CVE-2025-64332
Suricata versions before 7.0.13 and 8.0.2 are affected by a stack overflow when SWF decompression is enabled, which can cause the engine to crash. The issue has been patched in 7.0.13 and 8.0.2. Affected products: Suricata (IDS/IPS/NSM) by OISF. Root cause: stack overflow during SWF decompression...
CVE-2025-64332 Suricata is vulnerable to a stack overflow on larger compressed data
Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in version...
EUVD-2025-199774
Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in version...
TencentOS Server 3: bzip2 (TSSA-2025:0102)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0102 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
EUVD-2025-179845
Malicious code in catch-byte-decompress-cluster-assert npm...
EUVD-2025-176173
Malicious code in stub-emulate-decompress-view-sandbox npm...
EUVD-2025-180139
Malicious code in balance-decompress-authorize-query-thread npm...
EUVD-2025-178961
Malicious code in export-decompress-integer-encrypt-void npm...