CVE-2026-115396

Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesyste...

EUVD-2026-108332

Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesyste...

CVE-2026-106585

A flaw was found in OpenSSH. A remote attacker can trigger a denial of service DoS or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet...

CVE-2026-12669

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...

CVE-2026-12669

IBM MQ and IBM MQ Operator are affected by an out-of-bounds read vulnerability. An authenticated attacker can trigger this minor error by sending malformed compressed data . While the request is ultimately rejected, the underlying cause is a buffer error during data processing. The affected IBM M...

CVE-2026-12669 IBM MQ Out-of-bounds Read

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...

EUVD-2026-104464

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...

CVE-2026-12669: Out-of-bounds Read

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...

CVE-2026-97334

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libpng vulnerability (USN-8899-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8899-1 advisory. Ze Sheng discovered that libpng incorrectly handled certain compressed data chunks in PNG files. An...

ROS-20261012-73-0043

The vulnerability of the cgroupmigrateaddtask function in the kernel/cgroup/cgroup.c module of the Linux operating system is related to incorrect handling of highly compressed input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-105826

A security policy bypass exists in the ImageMagick MAT decoder in versions before 6.9.13-55 and 7.x before 7.1.2-30 . A remote attacker can submit a specially crafted MAT image containing highly compressed data that causes the decoder to fail to enforce configured temporary file size limits. This...

USN-8899-1 libpng1.6 vulnerability

Ze Sheng discovered that libpng incorrectly handled certain compressed data chunks in PNG files. An attacker could possibly use this issue to cause a denial of service...

CVE-2026-106452

A flaw was found in lz4-java. A remote attacker can trigger a Denial of Service DoS by providing a crafted compressed data stream with an oversized block header. During decompression, the input stream allocates memory based on this attacker-controlled size field before reading the actual payload,...

CVE-2026-66054

A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these...

AZL-106503 CVE-2026-94637 affecting package kata-containers 4.1.0.kata0-1

Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-94637

Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

UBUNTU-CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-94636

The Apache Thrift py bindings are vulnerable to improper handling of highly compressed data (data amplification), function calls with incorrectly specified arguments, and improper validation of specified quantities in input. Specifically, the Python TZlibTransport stops enforcing its decompressed...

thrift: thrift: Denial of Service via improper handling of compressed data

A flaw was found in the Apache Thrift C++ bindings. A remote, unauthenticated attacker could cause a Denial of Service DoS by sending specially crafted, highly compressed data payloads. Because the software does not properly restrict resource allocation during decompression, processing these...