CVE-2026-52687

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

UBUNTU-CVE-2026-52687

An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory, and open several such connections. The memory limit of the process is reached with only a few connections, terminating the process and all...

Linux Distros Unpatched Vulnerability : CVE-2026-15310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly...

PT-2026-89056

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14 Description The issue is a use-after-free condition occurring in the stream classes. The setDict, setLongMax, setLevel, and setRefMultipleDDicts functions fail to validate whether the stream is in a closed...

PT-2026-89055

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14 Description A use-after-free issue exists in the ZstdCompressCtx and ZstdDecompressCtx components. This occurs because streams and contexts hold a dictionary's shared lock only during the load call, which...

PT-2026-89054

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14 Description The Zstd.trainFromBufferDirect function fails to validate the samples buffer capacity. An attacker can provide crafted sample length arrays with oversized per-sample lengths, causing the native...

PT-2026-88917

Name of the Vulnerable Software and Affected Versions zstd-jni versions prior to 1.5.7-14 Description The ZstdDictCompress constructor fails to validate the offset and length parameters, leading to out-of-bounds memory reads. A remote attacker can provide untrusted values for these parameters to...

CVE-2026-70455

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...

Security Bulletin:Vulnerability in zstd affects IBM Netezza Appliance

Summary The zstd package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2021-24032 Vulnerability Details CVEID:CVE-2021-24032 DESCRIPTION: Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.11

Red Hat OpenShift Service Mesh 3.1.11 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.14

Red Hat OpenShift Service Mesh 3.0.14 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh...

SUSE SLED15 / SLES15 Security Update : apache-commons-compress, apache-ivy, brotli-java, zstd-jni (SUSE-SU-2026:3225-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3225-1 advisory. This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues...

Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni

This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: CVE-2026-26032: improper pathname limitation in PackagerResolver allows for arbitrary files writes outside of the configured buildRoot directory bsc1271727. Other updates an...

SUSE-SU-2026:3225-1 Security update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni

This update for apache-commons-compress, apache-ivy, brotli-java, zstd-jni fixes the following issue Security issues fixed: - CVE-2026-26032: improper pathname limitation in PackagerResolver allows for arbitrary files writes outside of the configured buildRoot directory bsc1271727. Other updates...

SUSE CVE-2026-64031

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 zerofsfillbiovec ... filemapaddfolio 1 zerofsbindcache...

EUVD-2026-45604

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 zerofsfillbiovec ... filemapaddfolio 1 zerofsbindcache...

CVE-2026-64031: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 zerofsfillbiovec ... filemapaddfolio 1 zerofsbindcache...

GHSA-GGW3-5987-RX77 Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Summary The HPKE V2 URL decode path in pkg/hpke/url.go decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow Pomerium Zero / hosted authenticate, the proxy's /.pomerium/callback endpoint is reachable without credentials...