CVE-2026-109226 SGLang through 0.5.21 Audio Decompression Amplification via load_audio

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

CVE-2026-109226

SGLang versions through 0.5.21 are vulnerable to a decompression amplification vulnerability within the load_audio function. This flaw allows remote attackers to trigger a denial of service (DoS) by submitting highly compressed, small FLAC-encoded silence files via audio_url or audio_data inputs....

CVE-2026-109226 SGLang through 0.5.21 Audio Decompression Amplification via load_audio

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-109226: Improper Handling of Highly Compressed Data (Data Amplification)

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-4063)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked...

Medium: fence-agents

Issue Overview: httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server t...

gd security update

2.3.3-20.1 - Fix LZW decompression in GIF handling CVE-2026-9672 Resolves: RHEL-259570...

EulerOS 2.0 SP13 : gzip (EulerOS-SA-2026-4052)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

EulerOS 2.0 SP11 : gzip (EulerOS-SA-2026-4325)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

Amazon Linux 2 : fence-agents (ALAS-2026-3988)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3988 advisory. httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in...

mongobleed

mongobleed CVE-2025-14847 - Explotación de fuga de memoria no autenticada en MongoDB Un exploit de prueba de concepto para la vulnerabilidad de descompresión zlib de MongoDB que permite a atacantes no autenticados filtrar memoria sensible del servidor. Vulnerabilidad Un fallo en la descompresión...

CVE-2026-108750

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

CVE-2026-108750

The OpenDocMan application versions 2.4.0 through 2.10.0 is vulnerable to a decompression bomb (CWE-409) during the upload text extraction process. This flaw allows authenticated users to exhaust PHP memory by uploading small, specially crafted ODT, DOCX, or XLSX files. When processed, the XML en...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

EUVD-2026-96915

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...

pyxamstore

Explorador de Xamarin AssemblyStore pyxamstore Esta es una versión alfa de un analizador de assemblies.blob AssemblyStore escrito en Python. La herramienta es capaz de desempaquetar y reempaquetar archivos assemblies.blob y assemblies.manifest de Xamarin desde un APK. Instalación Ejecute el scrip...