CVE-2026-83599 Netdata: WebSocket Decompression Bomb

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring Syst...

CVE-2026-83599: Improper Handling of Highly Compressed Data (Data Amplification)

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

PT-2026-96845

Name of the Vulnerable Software and Affected Versions Netdata versions prior to 2.11.0 Description The unauthenticated WebSocket server negotiates permessage-deflate before authentication. In the file src/web/websocket/websocket-compression.c, the function websocket client decompress message allo...

RHEL 8 : libsoup (RHSA-2026:69863)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69863 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding

A flaw was found in urllib3. A malicious server can trigger a Denial of Service DoS by returning a specially crafted compressed response containing trailing bytes. When streaming the response in chunks, the decompression logic can enter an infinite loop by repeatedly processing unconsumed data...

SUSE CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 9 : libsoup (RHSA-2026:69108)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69108 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

Updated python-httplib2 packages fix a security vulnerability

Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. CVE-2026-59939...

MGASA-2026-0419 Updated python-httplib2 packages fix a security vulnerability

Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. CVE-2026-59939...

Linux Distros Unpatched Vulnerability : CVE-2026-77528

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept...

Fedora 46 : python-streamlink / python-urllib3 (2026-3a61bdd470)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-3a61bdd470 advisory. Update python-urllib3 to version 2.8.0, fixing three security issues: - The TLS configuration for HTTPS proxies could be ignored or overridden. Rated high...