EUVD-2026-49136

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...

CVE-2026-41608: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-64883

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Ruby bindings. This issue occurs during ZLIB decompression within the THeaderTransport...

CVE-2026-66757: Integer Overflow or Wraparound

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions ysize and zsize are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value 65535, the...

PT-2026-64882

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data leads to a data amplification issue in the C++, Java, Python, Go, D, and C/GLib bindings. This occurs within the TZlibTransport decompression proces...

thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...

Uncontrolled Resource Consumption

phpoffice/phpspreadsheet is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the Gnumeric reader calling gzdecode on attacker-supplied compressed .gnumeric files without enforcing a decompressed-size limit, which allows an attacker to upload a specially crafted...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the gzfileGetContents process. An attacker can exhaust...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption bsc1268543...

EUVD-2026-46133

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation...

thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...

thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data also known as data amplification, allows a remote attacker to cause a Denial of Service DoS by sending specially crafted, highly compressed data. The affected component fails to...

CVE-2026-45820

fflate (versions up to 0.8.2) is vulnerable to denial of service through an infinite loop in unzipSync() when processing a crafted ZIP64 central directory entry: compressed_size=0xFFFFFFFF with missing ZIP64 extra tag 0x0001 causes out-of-bounds reads to yield 0, keeping the loop condition true. ...

The vulnerability of the gzfileGetContents() method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library allows a attacker to cause a service failure.

The vulnerability of the gzfileGetContents method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library is related to incorrect processing of highly compressed input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21372-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21372-1 advisory. This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of Arch package uploads, specifically when handling package file metadata. An attacker can cause excessive resource consumption by uploading a highly-compressed...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of Arch package uploads, specifically when handling package file metadata. An attacker can cause excessive resource consumption by uploading a highly-compressed...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the processing of Arch package uploads, specifically when handling package file metadata. An attacker can cause excessive resource consumption by uploading a highly-compressed...

CVE-2026-64031

A flaw was found in the Linux kernel's erofs filesystem. A race condition exists when processing unaligned compressed extents, which can cause a managed memory page folio to be incorrectly added to the page cache multiple times. This inconsistency in memory management could allow a local attacker...

EulerOS Virtualization 2.12.0 : rsync (EulerOS-SA-2026-2803)

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter...