CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

EUVD-2026-88978

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911

The Nicotine+ graphical client for the Soulseek peer-to-peer network is vulnerable to a decompression bomb in versions prior to 3.3.11 . A modified remote client can send zlib-compressed peer messages that, when processed, exhaust the recipient's operating system memory. This issue has been addre...

ROOT-OS-ALPINE-320-CVE-2026-85091 CVE-2026-85091 in zlib - Patched by Root

Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.20. Multiple fixed versions available...

CVE-2025-14847-mongobleed

CVE-2025-14847-mongobleed CVE-2025-14847 mongobleed archivo python CVE-2025-14847 CVE-2025-14847 https://jira.mongodb.org/browse/SERVER-115508 RESUMEN Esta es una corrección crítica para abordar CVE-2025-14847. Actualice a 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32 o 4.4.30. DESCRIPCIÓN DEL PROBLEMA E...

ROOT-OS-ALPINE-322-CVE-2026-85091 CVE-2026-85091 in zlib - Patched by Root

Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.22. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-85091 CVE-2026-85091 in zlib - Patched by Root

Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-324-CVE-2026-85091 CVE-2026-85091 in zlib - Patched by Root

Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.24. Multiple fixed versions available...

BIT-GDAL-2026-4738 GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal frmts/zlib/contrib/infback9 modules. This vulnerability is associated with program files inftree9.C‎. This issue affects gdal: before 3.11.0...

ROOT-OS-ALPINE-323-CVE-2026-85091 CVE-2026-85091 in zlib - Patched by Root

Root has patched CVE-2026-85091 in the zlib package for Root:Alpine:3.23. Multiple fixed versions available...

CVE-2026-46675

Use-after-free of zlib input in pngreadend after incomplete zTXt, iTXt or iCCP decompression...

CLEANSTART-2026-WR14423 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

Security vulnerability affects the langfuse package. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit...

CVE-2026-68911: Improper Handling of Highly Compressed Data (Data Amplification)

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

UBUNTU-CVE-2026-46675

Use-after-free of zlib input in pngreadend after incomplete zTXt, iTXt or iCCP decompression...

CVE-2026-46675

Use-after-free of zlib input in pngreadend after incomplete zTXt, iTXt or iCCP decompression...

CVE-2026-100723

A flaw was found in vm2. When an application permits the sandbox to access built-in Node.js modules such as the zlib compression library, returned data buffers fail to maintain memory isolation from the host system. An attacker executing untrusted code within the sandbox can inspect and alter the...

Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...