Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910. Patch Instructions: To install this SUSE...

SUSE-SU-2026:4650-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910...

Security update for python-urllib3

This update for python-urllib3 fixes the following issues: CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910. Patch Instructions: To install this SUSE...

SUSE-SU-2026:4649-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser bsc1283910...

K000163690: Apache Tomcat vulnerabilities CVE-2026-78437, CVE-2026-86248, and CVE-2026-87022

Security Advisory Description CVE-2026-78437 Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, fro...

EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2026-4339)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked...

EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2026-4248)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked...

Denial of Service (DoS)

Overview org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Denial of Service DoS via the CompressionUtils.inflate function. An...

SUSE-SU-2026:24125-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

SUSE-SU-2026:24217-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

OPENSUSE-SU-2026:22071-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override bsc1283908. - CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding bsc1283909. - CVE-2026-97689: denial of...

CVE-2026-78384

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

CVE-2026-78384 Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

EUVD-2026-95696

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

CVE-2026-78384

A vulnerability exists in Apache CXF (specifically the org.apache.cxf:cxf-core component) where the CompressionUtils.inflate() function fails to enforce an output-size cap when decompressing DEFLATE data. A remote attacker can exploit this by submitting a small, crafted payload that expands into ...

PT-2026-108816

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The CompressionUtils.inflate function decompresses attacker-controlled DEFLATE data without an output-size cap, allowing a...

CVE-2026-78384: Improper Handling of Highly Compressed Data (Data Amplification)

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

EUVD-2026-94588

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled...

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Impact With WebSocket compression enabled, the client inflates permessage-deflate messages with no limit on the decompressed size. It installed Netty's shared WebSocketClientCompressionHandler.INSTANCE, whose inflater is unbounded, and webSocketMaxFrameSize and webSocketMaxBufferSize only bound t...

GHSA-X8V2-478Q-2HVG AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Impact With WebSocket compression enabled, the client inflates permessage-deflate messages with no limit on the decompressed size. It installed Netty's shared WebSocketClientCompressionHandler.INSTANCE, whose inflater is unbounded, and webSocketMaxFrameSize and webSocketMaxBufferSize only bound t...