CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

CVE-2026-103262 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

SUSE CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

MGASA-2026-0463 Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Updated python-pillow packages fix security vulnerabilities

Prevent decompression bomb when parsing PDF WindowsViewer.getcommand injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds OOB read Out-of-bounds OOB read when saving 1 mode TGA images Out-of-bounds OOB write from large RankFilter sizes Out-of-bounds OOB write from...

Rocky Linux 8 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_32992)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202632992 advisory. urllib3: urllib3: Denial of Service due to excessive HTTP response decompression CVE-2026-44432 urllib3: urllib3: Information disclosure via cross-origin...

Rocky Linux 9 [CIQ] Security Update: python3.12-urllib3 Multiple Vulnerabilities (crlsa-2026_1088)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261088 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

Rocky Linux 9 [CIQ] Security Update: gzip / gzip-debuginfo / gzip-debugsource Multiple Vulnerabilities (crlsa-2026_61623)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661623 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via global...

Rocky Linux 8 [CIQ] Security Update: brotli / brotli-debuginfo / brotli-debugsource / brotli-devel / etc (crlsa-2026_2389)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20262389 advisory. Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS CVE-2025-6176 Tenable has extracted the preceding description block directly from the CIQ securi...

Rocky Linux 10.2 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc Multiple Vulnerabilities (crlsa-2026_67147)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service...

Rocky Linux 8 [CIQ] Security Update: python3.11-urllib3 Multiple Vulnerabilities (crlsa-2026_1224)

The Rocky Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261224 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

CVE-2026-103262: Improper Handling of Highly Compressed Data (Data Amplification)

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

Rocky Linux 10.2 [CIQ] Security Update: pacemaker-cluster-libs / pacemaker-cluster-libs-debuginfo / etc (crlsa-2026_40833)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202640833 advisory. pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression CVE-2026-10649 Tenable has extracted the preceding description bloc...

AlmaLinux 9.2 [TuxCare] Security Update: brotli / brotli-devel / libbrotli / python3-brotli (ALMALINUX9.2:CLSA-2026:1770911059)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770911059 advisory. - Scrapy versions up to 2.13.2 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The...

AlmaLinux 9.6 [TuxCare] Security Update: brotli / brotli-devel / libbrotli / python3-brotli (ALMALINUX9.6:CLSA-2026:1770911837)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770911837 advisory. - Scrapy versions up to 2.13.2 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The...

Rocky Linux 9 [CIQ] Security Update: bsdtar / bsdtar-debuginfo / libarchive / libarchive-debuginfo / etc (crlsa-2026_5080)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20265080 advisory. libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archivereaddata in libarchive CVE-2026-4111 Tenable has extracted the preceding description...

Rocky Linux 10.1 [CIQ] Security Update: bsdtar / bsdtar-debuginfo / libarchive / libarchive-debuginfo / etc (crlsa-2026_5063)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20265063 advisory. libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archivereaddata in libarchive CVE-2026-4111 Tenable has extracted the preceding description...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1768209702)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768209702 advisory. - The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a decompresse...

CVE-2026-103262: Improper Handling of Highly Compressed Data (Data Amplification)

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...