225 matches found
CVE-2026-53716
Envoy Gateway (open-source application gateway managing Envoy Proxy) has an unbounded gzip decompression vulnerability in getFileFromGZ within internal/wasm/httpfetcher.go. The function calls io.ReadAll on a gzip.Reader without limiting the decompressed output size. When a tenant-controlled Envoy...
CVE-2026-53659
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...
CVE-2026-53659
http4k is a functional Kotlin HTTP toolkit. The vulnerability (CWE-409) exists in ServerFilters.GZip , RequestFilters.GunZip , and the underlying gzip decompression functions, which imposed no cap on decompressed size . An unauthenticated client can send a small gzip-encoded request body that exp...
EUVD-2026-77694
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...
CVE-2026-53659 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...
tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption
A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...
Important: Red Hat Security Advisory: python-tornado security update
An update for python-tornado is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
Important: Red Hat Security Advisory: python-tornado security update
An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption
A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...
RHEL 10 : python-tornado (RHSA-2026:67147)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67147 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...
CVE-2026-85786
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...
CVE-2026-85786 Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...
CVE-2026-85786
Amazon ion-java before 1.12.1 contains an incomplete fix for CVE-2026-75936, a memory-amplification denial-of-service vulnerability. The root cause is insufficient coverage of the GZIP auto-decompression opt-out that was introduced to address CVE-2026-75936, allowing a remote attacker to supply a...
PT-2026-86241
Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...
EUVD-2026-56926
ffuf denial of service OOM via HTTP response decompression bomb...
Linux Distros Unpatched Vulnerability : CVE-2026-84382
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip,...
CVE-2026-49855
A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...
EUVD-2026-37014
gRPC Erlang package has unbounded gzip decompression decompression bomb...
CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...
EUVD-2026-61174
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...