Improper Resource Management.

compression is vulnerable to Improper Resource Management. The vulnerability is due to the zlib compression stream not being destroyed after a client disconnects, which allows a remote unauthenticated attacker to repeatedly initiate requests and terminate connections early, exhausting server memo...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed Divulgación de memoria por compresión zlib de MongoDB — Análisis, Detección y Corrección Resumen CVE-2025-14847, comúnmente conocido como MongoBleed , es una vulnerabilidad de divulgación de información de alta gravedad que afecta al :contentReferenceoaicite:0index=0...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS-STREAM8:CLSA-2025:1749826078)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1749826078 advisory. - inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2023:1699380056)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1699380056 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-2503...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1785428387)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785428387 advisory. - zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a...

Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1785320518)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785320518 advisory. - zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain ...

AlmaLinux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1785320518)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785320518 advisory. - zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a...

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

Affected package: adm-zip npm Affected version: 0.6.0 Summary The fix shipped for CVE-2026-39244 methods/inflater.js caps zlib's decompression output via maxOutputLength: expectedLength, where expectedLength is read directly from the ZIP entry's attacker-controlled "uncompressed size" header fiel...

DEBIAN-CVE-2026-102560

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

CVE-2026-102560

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

CVE-2026-68911

A flaw was found in nicotine-plus. A remote attacker can trigger a Denial of Service DoS by sending specially crafted, zlib-compressed peer messages containing a decompression bomb. When the recipient client decompresses the message, it exhausts available operating system memory, causing the...

CVE-2026-102560 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

CVE-2026-102560

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

EUVD-2026-89105

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow...

CVE-2026-102560

A heap buffer overflow vulnerability exists in libsoup within the permessage-deflate WebSocket extension . When processing very large outgoing messages, truncated size calculations for GByteArray growth can wrap, leading zlib to write past the allocated buffer. This issue can impact the availabil...

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

EUVD-2026-88978

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...