Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-125)

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service Improper Handling of Highly Compressed Data CWE-409 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding Streams management privileges could supply specially...

CVE-2026-73209

A flaw was found in Dovecot. An authenticated attacker can send specially crafted compressed data, leading to the affected process exhausting its stack and crashing. This termination of the process can result in degradation or a complete denial of service for the IMAP Internet Message Access...

PT-2026-84384

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Improper handling of highly compressed data can lead to a denial of service via excessive allocation. An authenticated user with Streams management privileges can provide specially crafted...

SUSE CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

Linux Distros Unpatched Vulnerability : CVE-2026-73209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is...

ALPINE-CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

AZL-98283 CVE-2026-73209 affecting package dovecot 2.3.20-1

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

EUVD-2026-67681

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

CVE-2026-73209 affects the IMAP process in Open-Xchange Dovecot , where an attacker with valid credentials can send crafted compressed data that causes the process to exhaust its stack and crash. The resulting process termination can lead to degradation or denial of service for IMAP services. The...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

CVE-2026-73209

An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process is terminated, which can cause degradation or denial of service for IMAP. Update to non-vulnerable version. No publicly available exploits...

PT-2026-83075

Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can send specially crafted compressed data that leads to stack exhaustion, causing the affected process to crash. This termination of the process can result in...

EUVD-2026-37014

gRPC Erlang package has unbounded gzip decompression decompression bomb...

EUVD-2026-61174

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

Denial Of Service (DoS)

Apache Thrift Ruby bindings are vulnerable to Denial Of Service. The vulnerability is due to improper handling of highly compressed data, where crafted compressed input can cause excessive data amplification and resource consumption, leading to application unavailability...

thrift: Apache Thrift Ruby bindings: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift Ruby bindings. This vulnerability, categorized as improper handling of highly compressed data, allows a remote attacker to cause a denial of service DoS through a data amplification attack. By sending specially crafted highly compressed data, an attacker can...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

SUSE CVE-2026-48586

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...