CVE-2026-18212 Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...

CVE-2026-18212

Keycloak 's SAML Redirect Binding implementation is affected by a native memory leak. The custom DEFLATE compression and decompression helpers fail to release native zlib memory after processing, so an unauthenticated attacker can send repeated malformed SAML requests to exhaust native memory and...

EUVD-2026-80828

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...

CVE-2026-18212

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...

CVE-2025-14847---MongoBleed

Mongobleed CVE-2025-14847 – Go 概念验证（PoC） 本仓库包含针对 CVE-2025-14847 的 Go 概念验证漏洞利用程序，该漏洞是 MongoDB 的一个内存泄露漏洞，通常被称为 Mongobleed 。 该 PoC 是 Joe Desimone 原始 Python 漏洞利用程序的 Go 重实现，可在此获取： https://github.com/joe-desimone/mongobleed 该漏洞利用程序利用 zlib 解压和 BSON 解析缺陷，从存在漏洞的 MongoDB 服务器中泄露未初始化内存。 阅读博客文章 -...

CVE-2025-14847-MongoBleed

CVE-2025-14847 MongoBleed MongoDB zlib 压缩内存泄露 — 分析、检测与修复 概述 CVE-2025-14847，通常被称为 MongoBleed ，是一个影响 MongoDB 服务器的高危信息泄露漏洞。 该漏洞允许远程、未授权攻击者 通过利用对 zlib 压缩网络消息处理不当，泄露服务器内存中的敏感数据。 该问题已在野外被积极利用，并影响使用默认压缩配置的 MongoDB 部署。 CVE 编号： CVE-2025-14847 严重等级： 高危（CVSS 8.7） 攻击向量： 网络 是否需要认证： 否 用户交互： 无 利用状态： 已确认活跃利用 技术摘...

tinyxml

/ @mainpage TinyXML TinyXML 是一个简单、小巧的 C++ XML 解析器，可以轻松集成到其他程序中。 它能做什么。 简而言之，TinyXML 解析 XML 文档，并从中构建一个文档对象模型（DOM），该模型可以被读取、修改和保存。 XML 代表“可扩展标记语言”。它允许你创建自己的文档标记。HTML 在为浏览器标记文档方面做得非常好，而 XML 允许你定义任何类型的文档标记，例如描述一个用于日程管理应用程序的“待办事项”列表的文档。XML 是一种非常结构化且方便的格式。所有那些用于存储应用程序数据的随机文件格式都可以被 XML 取代。一个解析器适用于所有。...

cart

CaRT（压缩与 RC4 传输） CaRT 文件格式用于存储/传输恶意软件及其相关元数据。它会使恶意软件失效，使其无法执行，并对其进行加密，从而避免杀毒软件将 CaRT 文件标记为恶意软件。 优势 快速：CaRT 与压缩文件一样快 流式处理：CaRT 使用 zlib 和 RC4，支持对流式数据进行编码 元数据：CaRT 可以将文件元数据与文件本身存储在同一个文件中，无需读取整个文件即可读取元数据 哈希计算：CaRT 在编码文件的同时计算文件的哈希值，并将该信息存储在页脚中 体积：由于使用了压缩，CaRT 文件通常比原始文件更小。（除非在 CaRT 中存储了大量元数据） 将 CaRT 与...

CVE-2026-92000

A flaw was found in adm-zip. A remote attacker could exploit this vulnerability by crafting a malicious ZIP archive containing highly compressible entries that declare a zero uncompressed size. This oversight prevents the application of zlib decompression output limits, leading to excessive memor...

CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...

EUVD-2026-80001

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-92000

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft...

Astra Linux – Vulnerability in Netty

In Netty 4.1.x before 4.1.46, the ZlibDecoders allowed unbounded memory allocation when decoding Zlib-encoded byte streams. An attacker could send a large Zlib-encoded byte stream to the Netty server, forcing the server to allocate all of its available memory to a single decoder...

Astra Linux – Vulnerability in zlib, libz-mingw-w64

Zlib versions up to 1.2.12 have a heap-based buffer over-read or buffer overflow issue in the inflate function within inflate.c, due to a large gzip header extra field. NOTE: Only applications that call inflateGetHeader are affected. Some common applications bundle the affected Zlib source code,...

Astra Linux – Vulnerability in gst-plugins-good1.0

DOS: Potential heap overwrite in qtdemux using zlib decompression. Integer overflow in the qtdemux element within the qtdemuxinflate function can lead to a segfault, or it may cause a heap overwrite, depending on the libc and operating system. Depending on the libc used and the underlying operati...

Astra Linux – Vulnerability in gst-plugins-good1.0

DOS: Potential heap overwrite during MKV demuxing using Zlib decompression. Integer overflow occurs in the matroskademux element within the gstmatroskadecompressdata function, which can cause a segfault—or potentially a heap overwrite, depending on the libc and operating system. Depending on the...

CVE-2026-5132

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...

CVE-2026-5132

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to limit the size of unpacked SDP messages compressed with zlib in Calls WebSocket messages. An authenticated attacker (low privileges) can send many SDP messages that decompress to a large size, ca...

CVE-2026-5132 Unbounded zlib decompression in Calls SDP WebSocket messages

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...

EUVD-2026-77370

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...