Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-2159)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2159 advisory. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper bounda...

Important: libsoup3

Issue Overview: A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed...

Important: libsoup

Issue Overview: A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf

ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387

Suricata , a network IDS/IPS/NSM engine, is affected by a decompression bomb vulnerability in its HTTP/2 decompression path . Prior to versions 7.0.16 and 8.0.5 , a crafted HTTP/2 DATA payload using a high compression ratio (gzip, deflate, or brotli) could cause Suricata to allocate excessive mem...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3300)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3375)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

Linux Distros Unpatched Vulnerability : CVE-2026-84890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is...

PT-2026-86241

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

CVE-2026-82520

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a...

ffuf denial of service (OOM) via HTTP response decompression bomb

Summary A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body a decompression bomb. This works against default usage with no special flags. Details The response body size guard...

GHSA-JCVH-XF52-2CWM ffuf denial of service (OOM) via HTTP response decompression bomb

Summary A malicious or attacker-controlled target server can crash ffuf with an out-of-memory condition by returning a compressed HTTP response that decompresses to a very large body a decompression bomb. This works against default usage with no special flags. Details The response body size guard...

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Summary ZipArchiver::extract lacks limits on uncompressed size, file count, and nesting depth, creating a distinct, unpatched variant of the GHSA-2vcx-h8p2-9pg9 zip bomb vulnerability. While the parallel method Installer::unZip received comprehensive limits, ZipArchiver::extract remains...

GHSA-928X-9MPW-8H56 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Summary ZipArchiver::extract lacks limits on uncompressed size, file count, and nesting depth, creating a distinct, unpatched variant of the GHSA-2vcx-h8p2-9pg9 zip bomb vulnerability. While the parallel method Installer::unZip received comprehensive limits, ZipArchiver::extract remains...