CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Sliver C2의 HTTPS 리스너에 대한 서비스 거부DoS 익스플로잇입니다. 세션별 PNG 인코딩 nonce를 무차별 대입brute-force하여 서버 메모리를 고갈시키는 압축 해제 폭탄decompression bomb을 전달합니다. GHSA-663m-7x7m-g4fw로 공개되었습니다. 요약 Sliver의 HTTPS C2 채널은 메시지를 PNG 이미지 내부에 래핑합니다. 각 세션에는 1, 65537 범위의 무작위 nonce가 할당되며, 서버는 ?n= 쿼리 매개변수가 세션의...

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

ImpactDenial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed...

vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

SummaryThe audio decode-duration guard maxdurations, env VLLMMAXAUDIODECODEDURATIONS, default 600s that protects against audio decompression-bomb DoS is wired into only the speech-to-text path /v1/audio/transcriptions. The chat audio path /v1/chat/completions, inputaudio content parts calls the...

CVE-2026-103262

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262

Tornado versions before 6.5.9 are vulnerable to a Denial of Service (DoS) attack via the CurlAsyncHTTPClient component. The root cause is an unbounded memory accumulation vulnerability where the client fails to enforce limits on incoming response sizes. A remote malicious server can exploit this ...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

MGASA-2026-0463 Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Rocky Linux 9.6 [TuxCare] Security Update: brotli / brotli-devel / libbrotli / python3-brotli (ALMALINUX9.6:CLSA-2026:1770911837)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770911837 advisory. - Scrapy versions up to 2.13.2 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. T...

Rocky Linux 9 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_1088)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261088 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

AlmaLinux 9.2 [TuxCare] Security Update: brotli / brotli-devel / libbrotli / python3-brotli (ALMALINUX9.2:CLSA-2026:1770911059)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770911059 advisory. - Scrapy versions up to 2.13.2 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The...

Rocky Linux 8 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_1226)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261226 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

Rocky Linux 8 [CIQ] Security Update: resource-agents / resource-agents-aliyun / etc Multiple Vulnerabilities (crlsa-2026_1241)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261241 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

Rocky Linux 8 [CIQ] Security Update: python3-urllib3 Multiple Vulnerabilities (crlsa-2026_1254)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261254 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

PT-2026-103795

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

Rocky Linux 10.1 [CIQ] Security Update: brotli / brotli-debuginfo / brotli-debugsource / brotli-devel / etc (crlsa-2026_0845)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260845 advisory. Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS CVE-2025-6176 Tenable has extracted the preceding description block directly from the CIQ...

Linux Distros Unpatched Vulnerability : CVE-2026-103262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of...