UBUNTU-CVE-2026-53524

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

EUVD-2026-64185

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524

WeeChat versions 4.3.0 through 4.9.0 contain a decompression bomb vulnerability in the relay module's WebSocket permessage-deflate decompression function (relay_websocket_inflate()). The function imposes no upper bound on output size, allowing an authenticated relay user to send a small compresse...

grok:grk_decompress_mercury_fuzzer: Heap-buffer-overflow in bool grk::GrkImage::compositePlanar<int>

Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6270477761576960 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressmercuryfuzzer Job Type: libfuzzerasangrok...

libfreerdp H.264 Information Disclosure

The vulnerability in the libfreerdp/codec/h264.c file of the H.264 decompression subsystem of the RDP client FreeRDP relates to reading data beyond the permitted range of memory. Exploiting this vulnerability can allow an attacker to cause service failures and expose sensitive information...

Linux Distros Unpatched Vulnerability : CVE-2026-77640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causi...

CVE-2026-54464

A flaw was found in the websocket-driver library. When used with the permessage-deflate extension, a remote attacker can send compressed WebSocket messages that, upon decompression, exceed the configured maximum message size. This occurs because the size limit is checked against the compressed da...

DEBIAN-CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

Tor before 0.4.9.9 is vulnerable to a denial of service when decompressing a truncated zlib/gzip stream with done=1. The root cause is in buf_add_compress() : a truncated stream never reaches Z_STREAM_END, so zlib returns Z_BUF_ERROR with no input remaining, which the function misinterpreted as a...

EUVD-2026-63650

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

CVE-2026-77640

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches ZSTREAMEND, causing zlib to return ZBUFERROR with no input remaining, which bufaddcompress mistook for a full output buffer and retried forever. Fixed by...

[SECURITY] [DLA 4748-1] python-httplib2 security update

Debian LTS Advisory DLA-4748-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias August 20, 2026 https://wiki.debian.org/LTS Package : python-httplib2 Version : 0.20.4-3+deb12u1 CVE ID : CVE-2026-59939 A flaw was discovered in python-httplib2, a comprehensive Python...