CVE-2026-18929: Improper Handling of Highly Compressed Data (Data Amplification)

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

PT-2026-76909

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

PT-2026-73393

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

EUVD-2026-59805

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

CVE-2026-74767

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

CVE-2026-74767

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

CVE-2026-74767

Pandora has a DoS in DAA extraction: unbounded decompression of DAA chunks caused memory and CPU exhaustion. The fix uses bounded decompression (decompressobj().decompress()) with max_extracted_filesize, checks cumulative decompressed size, and raises a ZipBomb when the limit is exceeded, abortin...

PT-2026-73062

Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Pandora contains a denial-of-service issue in its handling of DAA Direct Access Archive files. During the extraction of an internal ISO image from a DAA archive, the system uses the...

CVE-2026-14298

CVE-2026-14298 affects Mattermost releases: 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22. An authenticated user can trigger denial of service by causing resource exhaustion while processing certain user-supplied input. The CVE has a base score of 6.5 (MEDIUM) under CV...

CVE-2026-14298 Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk...

CVE-2026-63133

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

EUVD-2026-56969

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

CVE-2026-63133

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat...

SUSE-SU-2026:23142-1 Security update for python-httplib2

This update for python-httplib2 fixes the following issue - CVE-2026-59939: Fixed a vulnerability where a malicious or compromised HTTP server could return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

EUVD-2026-49768

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...

CVE-2026-66913 Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application...