CVE-2024-3094-analysis

CVE-2024-3094 – Real-World Supply Chain Threat What is CVE-2024-3094? CVE-2024-3094 is a major backdoor vulnerability discovered in the xz compression library. It allows attackers to potentially execute code remotely through SSH. The vulnerability was introduced intentionally and affects critical...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components. The XZ Backdoor: A Supply‑Chain Threat that Reaches...

external_zlib-1.2.7_CVE-2018-25032

ZLIB DATA COMPRESSION LIBRARY zlib 1.2.7 is a general purpose data compression library. All the code is thread safe. The data format used by the zlib library is described by RFCs Request for Comments 1950 to 1952 in the files http://tools.ietf.org/html/rfc1950 zlib format, rfc1951 deflate format...

Astra Linux – Vulnerability in zlib, libz-mingw-w64

Before version 1.2.12, zlib allowed memory corruption during deflation i.e., when compressing if the input contained many distant matches...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read, allowing attackers to trigger infinite loops. Attackers can pass negative length values to cause the read method to spin indefinitely while holding the stream monitor, blocki...

CVE-2026-87823

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MINVALUE to read unmapped memory, causing JVM...

UBUNTU-CVE-2026-87795

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashe...

CLEANSTART-2026-FR63847 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the node:zlib synchronous APIs when a spoofed TypedArray byteLength triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra 4.0

Summary Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8....

EulerOS Virtualization 2.12.0 : xz (EulerOS-SA-2026-2812)

According to the versions of the xz packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzmaindexdecoder was us...

perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob

A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of...

[SECURITY] Fedora 44 Update: perl-Compress-Raw-Bzip2-2.218-1.fc44

This module provides a Perl interface to the bzip2 compression library. It is used by IO::Compress::Bzip2...

PT-2026-43487

Name of the Vulnerable Software and Affected Versions IO::Compress versions 2.207 through 2.219 Description The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field tag 0x7875 where the UID Size or GID Size is set to 8. This occurs because the decode ux function trigge...

JLSEC-2026-477

zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...

JLSEC-2026-478

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call...

CVE-2026-6535

Wireshark contains a vulnerability CVE-2026-6535 in its dissection engine where a zlib decompression crash is triggered by improper control of sequential memory allocation. Affected versions are Wireshark 4.6.0–4.6.4 and 4.4.0–4.4.14, leading to denial of service. The issue is described in the CV...

GHSA-4C3Q-X735-J3R5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

Executive Summary This report documents a critical security research finding in the compressing npm package specifically tested on the latest v2.1.0. The core vulnerability is a Partial Fix Bypass of CVE-2026-24884. The current patch relies on a purely logical string validation within the...

CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...

CVE-2026-27820

zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstreambufferungets function prepends caller-provided bytes ahead of previously produced output but...