457 matches found
EUVD-2026-37014
gRPC Erlang package has unbounded gzip decompression decompression bomb...
CVE-2026-53524
A flaw was found in WeeChat. An authenticated user of the relay module's WebSocket functionality can send a small compressed frame that, when decompressed, expands to a significantly larger size. This "decompression bomb" can exhaust all available server memory, leading to a Denial of Service DoS...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-53524
WeeChat versions 4.3.0 through 4.9.0 contain a decompression bomb vulnerability in the relay module's WebSocket permessage-deflate decompression function (relay_websocket_inflate()). The function imposes no upper bound on output size, allowing an authenticated relay user to send a small compresse...
CVE-2026-53524
WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...
CVE-2026-54464
A flaw was found in the websocket-driver library. When used with the permessage-deflate extension, a remote attacker can send compressed WebSocket messages that, upon decompression, exceed the configured maximum message size. This occurs because the size limit is checked against the compressed da...
JetBrains YouTrack < 2026.2.18177 DoS (CVE-2026-75047)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18177. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via a decompression bomb in the import endpoint. CVE-2026-75047 Note that Nessus has not tested for this issue but...
CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...
CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...
CVE-2026-53524
GHSA-v2v4-45wm-5cr3: Decompression Bomb in Relay WebSocket DoS...
UBUNTU-CVE-2026-53524
GHSA-v2v4-45wm-5cr3: Decompression Bomb in Relay WebSocket DoS...
CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...
CVE-2026-75047
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
CVE-2026-75047
JetBrains YouTrack before version 2026.2.18177 is vulnerable to a denial-of-service attack via a decompression bomb submitted to the import endpoint. A low-privileged authenticated user can trigger high availability impact (CVSS 6.5) without user interaction. Exploitation details are not provided...
CVE-2026-75047
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
EUVD-2026-60246
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
CVE-2026-75047
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...
