48 matches found
CVE-2026-53659 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...
CVE-2026-53659: Improper Handling of Highly Compressed Data (Data Amplification)
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...
CVE-2026-45752 Suricata detect/transform: use-after-free in decompress transforms
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after i...
CVE-2026-45752: Use After Free
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after i...
GHSA-6CCX-9C9F-327W gRPC Erlang package has unbounded gzip decompression (decompression bomb)
Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compressed frame that decompresses to gigabytes, exhausting the BEAM node's heap and triggering an OOM kill denial of service. Introduced in...
GHSA-G4W2-6H2R-3M3W http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...
PT-2026-76889
Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...
MAL-2026-14056 Malicious code in gunzip-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...
Malicious code in gunzip-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...
EUVD-2001-0087
Malware in sbrugna...
EUVD-2003-0939
Malware in sbrugna...
CVE-2025-49163
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file...
Arris VIP1113 安全漏洞
The Arris VIP1113 is a set-top box for HD IPTV services from Arris USA. A security vulnerability exists in the Arris VIP1113 version 2025-05-30 and earlier, which stems from a specially crafted /usr/bin/gunzip file that could lead to arbitrary image booting...
CVE-2025-49163: Improper Protection of Alternate Path
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file...
CVE-2025-49163
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file...
The vulnerability of microprogrammed software in Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows a perpetrator to execute arbitrary code.
The vulnerability of the microprogrammed software of the Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...
SUSE CVE-2005-0638
xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command...
CLSA-2021-1635459154 Fix CVE(s): CVE-2021-28831
SECURITY UPDATE: operation on invalid pointer - debian/patches/CVE-2021-28831.patch: decompressgunzip.c mishandles the error bit on the huftbuild result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. - CVE-2021-28831...
The vulnerability of the `huft_build` function in the `archival/libarchive/decompress_gunzip.c` component of the BusyBox command-line utility suite, related to the manipulation of the null pointer, allows a malicious actor to trigger a denial-of-service attack.
The vulnerability of the huftbuild function in the archival/libarchive/decompressgunzip.c file of the UNIX utility command-line tool BusyBox is related to the use of a null pointer. Exploiting this vulnerability allows an attacker to cause a service failure by using a specially created ZIP file...