CVE-2026-66038

FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlibdecomp functi...

PT-2026-64414

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2 Description An information disclosure issue exists in the LCL/ZLIB video decoder. An attacker can expose uninitialized heap memory by providing a valid zlib stream that inflates to fewer bytes than the expected...

Security Bulletin: AIX is vulnerable to denial of service due to zlib (CVE-2026-27171)

Summary A vulnerability in zlib could allow a remote attacker to cause a denial of service CVE-2026-27171. AIX uses zlib as part of its data compression functions. Vulnerability Details CVEID:CVE-2026-27171 DESCRIPTION: zlib before 1.3.2 allows CPU consumption via crc32combine64 and...

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

GHSA-MVH2-CRG5-V77C Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Summary Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has already exceeded maxHeaderSize and marked the frame truncated. At commit b2d2137c4404af425bf9d5d601a62576f5c06925, a 12,253-byte compressed SPDY header block can declare and inflat...

Vulnerabilities found in Oracle Communications

Oracle has identified vulnerabilities in its Communications products and underlying third-party software. There are a total of 213 vulnerabilities, of which 67 reside in Oracle products and 146 in third-party products that have already received updates. The most serious vulnerabilities, 12 in...

Vulnerabilities in Oracle database products

Oracle has identified 158 vulnerabilities in Oracle Database Server, APEX, Autonomous Health Framework, Essbase, Global Lifecycle Management, GoldenGate, NoSQL Database, Spatial Studio, SQLDeveloper, and TimesTen In-Memory Database. Of these vulnerabilities, 91 originate from third-party products...

AIX is vulnerable to denial of service due to zlib (CVE-2026-27171)

IBM SECURITY ADVISORY First Issued: Wed Jul 22 02:19:43 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/zlibadvisory3.asc Security Bulletin: AIX is vulnerable to denial of service due to zlib CVE-2026-27171...

EulerOS Virtualization 2.10.0 : zlib (EulerOS-SA-2026-2874)

According to the versions of the zlib package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop th...

EulerOS Virtualization 2.10.1 : zlib (EulerOS-SA-2026-2843)

According to the versions of the zlib package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop th...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty (network application framework) contains a vulnerability in SPDY header decoding. Prior to versions 4.1.136.Final and 4.2.16.Final, the zlib-compressed header blocks may continue inflating after the header parser exceeds maxHeaderSize, allowing a remote peer to send a small compressed HEADE...

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

Security Bulletin: IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent, is affected by a security vulnerability in Perl

Summary IBM Tivoli Monitoring is included with IBM Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent and has remediated a vulnerability in the Zlib library. Vulnerability Details CVEID:CVE-2026-4176 DESCRIPTION: Perl versions from 5.9.4 before 5.40.4-RC1, from...

AZL-92516 CVE-2026-63825 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflatefast, the inner copy loops get transformed ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decode function of PdfStream in PdfParser, where zlib decompression is performed without limiting the output size. An attacker can cause excessive memory consumption by...

Security update for wireshark

This update for wireshark fixes the following issues CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5403: SBC audio codec crash bsc1263765. CVE-2026-5404: K12 RF5 file parser crash bsc1263766. CVE-2026-5406: FC-SWILS dissector crash bsc1263754. CVE-2026-5407: SMB2 dissector infinite loop...

EulerOS 2.0 SP10 : zlib (EulerOS-SA-2026-2679)

According to the versions of the zlib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no...