EUVD-2023-44415

Malicious code in bioql PyPI...

EUVD-2024-3533

Malicious code in bioql PyPI...

EUVD-2023-2981

Malicious code in bioql PyPI...

EUVD-2024-16245

Malicious code in bioql PyPI...

EUVD-2025-10959

Malicious code in bioql PyPI...

EUVD-2025-21056

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2023-22898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - workers/extractor.py in Pandora aka pandora-analysis/pandora 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP archive aka ZIP bomb...

CVE-2025-58057 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

CVE-2025-58057

CVE-2025-58057 is a Netty vulnerability where, in affected releases of netty-codec-compression (≤ 4.1.124.Final) and netty-codec (≤ 4.2.4.Final), specially crafted input can cause BrotliDecoder and related decoders to allocate a large number of reachable byte buffers, leading to denial of service...

GHSA-3P8M-J85Q-PGMJ Netty's decoders vulnerable to DoS via zip bomb style attack

Summary With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time...

Netty's decoders vulnerable to DoS via zip bomb style attack

Summary With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time...

PT-2025-36605

Summary With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. Details BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time...

Linux Distros Unpatched Vulnerability : CVE-2017-16129

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes sever...

SUSE CVE-2025-53633

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario i.e. a zip archive, the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, ...

GO-2025-3810 Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager

Chall-Manager's scenario decoding process does not check for zip bombs in github.com/ctfer-io/chall-manager...

Fedora 41 : rust-sequoia-octopus-librnp (2025-71b9c49854)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-71b9c49854 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...

Fedora 42 : rust-sequoia-octopus-librnp (2025-51c16d6993)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-51c16d6993 advisory. Update to version 1.11.1. This version includes a fix for a potential DoS-via-zip-bomb issue. Release notes:...

Fedora: Security Advisory (FEDORA-2025-51c16d6993)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-53633

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario i.e. a zip archive, the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, ...

Denial Of Service (DoS)

github.com/ctfer-io/chall-manager is vulnerable to Denial Of Service DoS. The vulnerability is due to the lack of size validation when decoding zip archives, which allows an attacker to exploit the system using zip bomb decompression without requiring authentication or authorization...