RHEL 9 : python-tornado (RHSA-2026:90283)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:90283 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

PT-2026-132419

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

LabStack Echo resource management error vulnerability

In LabStack Echo versions from 4.0.0 up to but including 4.16.1, there is a resource management error vulnerability. This vulnerability arises because the Decompress middleware fails to limit the size of the request body after gzip decompression. As a result, small-compressed requests can be...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

Important: python3.13-tornado

Issue Overview: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory...

Linux Distros Unpatched Vulnerability : CVE-2026-90797

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via...

RHEL 10 : python-tornado (RHSA-2026:80741)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:80741 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

CVE-2026-90797

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

UBUNTU-CVE-2026-90797

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

EUVD-2026-105156

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797

Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to a pre-authentication gzip decompression bomb . The issue resides in the chttpd component, where an unlimited gzip decompression routine allows a remote client to trigger a denial of service (DoS) by causing memory exhausti...

CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

PT-2026-118484

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 3.5.3 Description A denial of service can be triggered via memory exhaustion due to an unlimited gzip decompression routine in the chttpd component. This allows any remote client to crash the service...

Apache CouchDB resource management error vulnerability

Apache CouchDB versions 3.5.2 and earlier contain a resource management error vulnerability. This vulnerability stems from the gzip decompression routine in chttpd failing to limit the size of decompressed data, potentially allowing arbitrary remote clients to cause a denial of service by...

CVE-2026-111924 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

CVE-2026-111924

Versions of Fleet prior to 4.83.0 are vulnerable to a Denial of Service (DoS) attack caused by unbounded gzip decompression . An unauthenticated attacker can exhaust server memory by sending small, highly compressed request bodies to unauthenticated endpoints using the Content-Encoding: gzip head...