CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

GHSA-6CP7-3M3C-5X5C Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Impact Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed...

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Impact Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed...

CVE-2026-83599 Netdata: WebSocket Decompression Bomb

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

CVE-2026-83599 Netdata: WebSocket Decompression Bomb

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

CVE-2026-83599 Netdata: WebSocket Decompression Bomb

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that...

CVE-2026-61652

Zapros , a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion . The root cause is that its streaming decoders ignored the requested chunk size (both explicit iter_bytes(chunk_size=...) and the default), allowing a single compressed response chunk ...

CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that...

CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

Security update for libheif

This update for libheif fixes the following issues: CVE-2026-84383: Heap buffer overflow in scalenearestneighbor via duplicate alpha planes from nested iden/auxl items bsc1279443. CVE-2026-84384: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS...

MGASA-2026-0419 Updated python-httplib2 packages fix a security vulnerability

Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. CVE-2026-59939...

Updated python-httplib2 packages fix a security vulnerability

Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. CVE-2026-59939...

Memory Allocation with Excessive Size Value

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the async decompression path in methods/inflater.js, where the decompression size cap enforced by zlib's...

CVE-2026-84384 libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompressbrotli and doinflate to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no outpu...