CVE-2026-80892

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. On systems with a high number of processing units, mounting a specially crafted EROFS image can cause the kernel to allocate an excessive amount of memory for LZMA decompression streams. This uncontrolled memor...

CVE-2026-90797

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

EUVD-2026-105156

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797

Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to a pre-authentication gzip decompression bomb . The issue resides in the chttpd component, where an unlimited gzip decompression routine allows a remote client to trigger a denial of service (DoS) by causing memory exhausti...

resteasy security update

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list RESTEasy contains a JBoss project that provides frameworks to help build...

Decompression Bomb

Apache CXF is vulnerable to a decompression bomb. The vulnerability is due to CompressionUtils.inflate decompressing attacker-controlled DEFLATE data without an output-size limit, where a small KB crafted payload can expand to gigabytes on the heap and attackers can trigger it via JWE decryption...

PT-2026-120344

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

DEBIAN-CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...

ALSA-2026:85234 Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode...

resteasy security update

3.0.26-20.1 - Fix CVE-2026-89058: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config - Fix CVE-2026-89059: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS - Resolves: RHEL-278032 - Resolves: RHEL-277999...

PT-2026-117658

Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 12.x Description A denial of service issue exists where the library can retain a rejected GIF frame size after a decompression-bomb exception is raised. In the GifImageFile. seek function, a specially crafted GIF...

Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode...

CVE-2026-111924

Versions of Fleet prior to 4.83.0 are vulnerable to a Denial of Service (DoS) attack caused by unbounded gzip decompression . An unauthenticated attacker can exhaust server memory by sending small, highly compressed request bodies to unauthenticated endpoints using the Content-Encoding: gzip head...

CVE-2026-111924 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

CVE-2026-111924 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...