PT-2026-77297

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

CVE-2026-75936: Improper Handling of Highly Compressed Data (Data Amplification)

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the Body.gunzipped and Body.gunzippedStream paths in core/core/src/main/kotlin/org/http4k/filter/Gzip.kt and the RequestFilters.GunZip request filter in...

GHSA-G4W2-6H2R-3M3W http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...

BIT-NIFI-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

PT-2026-76889

Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...

Unity Linux 20.1070e Security Update: gzip (UTSA-2026-099524)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099524 advisory. GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompressi...

Unity Linux 20.1070e Security Update: gzip (UTSA-2026-099505)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099505 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...

PT-2026-73393

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

gzip-1.14-3.1 on GA media (moderate)

gzip-1.14-3.1 on GA media Announcement ID: openSUSE-SU-2026:11518-1 Rating: moderate Cross-References: CVE-2026-41992 CVSS scores: CVE-2026-41992 SUSE : 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVE-2026-41992 SUSE : 6.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N...

OPENSUSE-SU-2026:11518-1 gzip-1.14-3.1 on GA media

These are all security issues fixed in the gzip-1.14-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76444

These are all security issues fixed in the gzip-1.14-3.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] [DSA 6441-1] python-httplib2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6441-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 14, 2026 https://www.debian.org/security/faq -...

Debian dsa-6441 : python3-httplib2 - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6441 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6441-1 [email protected] https://www.debian.org/security/...

SUSE SLED15 / SLES15 Security Update : gzip (SUSE-SU-2026:3592-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3592-1 advisory. - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state...

CVE-2026-48702

CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

SUSE SLES12 Security Update : gzip (SUSE-SU-2026:3590-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3590-1 advisory. - CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state between different decompression...

TencentOS Server 2: python3 (TSSA-2026:0847)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0847 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...