CVE-2026-44162 fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

EUVD-2026-77705

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-44162

fluent-plugin-s3 (versions 0.7.0 to 1.8.4) is vulnerable to a decompression bomb in its in_s3 input plugin (CWE-409). The plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload o...

CVE-2026-44162 fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-89321

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

CVE-2026-89321

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

Important: libsoup3

Issue Overview: A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed...

Important: libsoup

Issue Overview: A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-2159)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2159 advisory. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper bounda...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2160)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2160 advisory. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper bounda...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

GO-2026-6369 ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf

ffuf denial of service OOM via HTTP response decompression bomb in github.com/ffuf/ffuf...

CVE-2026-46387

Suricata , a network IDS/IPS/NSM engine, is affected by a decompression bomb vulnerability in its HTTP/2 decompression path . Prior to versions 7.0.16 and 8.0.5 , a crafted HTTP/2 DATA payload using a high compression ratio (gzip, deflate, or brotli) could cause Suricata to allocate excessive mem...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3375)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3300)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...