4840 matches found
CVE-2026-102477
The io.vertx:vertx-gprc-server component in Eclipse Vert.x (versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and [5.2.0, 5.2.0]) is vulnerable to a compression bomb attack . While gRPC endpoints have a configurable maximum message size, the restriction only applies to the compressed siz...
EUVD-2026-101937
In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...
CVE-2026-102477
In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...
CVE-2026-102477
In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...
CVE-2026-110926
Rejected reason: CVE-2026-110926 has been marked as a duplicate of CVE-2026-106582...
CVE-2026-110926
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...
CLEANSTART-2026-YW37682 yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...
CLEANSTART-2026-GT24966 yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106452 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...
CLEANSTART-2026-XJ09918 yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106450 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...
CVE-2026-102477: Improper Handling of Highly Compressed Data (Data Amplification)
In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...
CVE-2026-110927: Allocation of Resources Without Limits or Throttling
Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585...
PT-2026-114833
In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. When applied to a compressed message, this only applies to the compressed si...
CLEANSTART-2026-MS32897 yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...
SUSE CVE-2026-109268
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused,...
openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...
CVE-2026-109257
A flaw was found in FreeRDP. A remote attacker using a specially crafted Remote Desktop Protocol RDP client can request NSCodec compression with large display dimensions to trigger a memory allocation failure on the server. Because the server fails to properly clear memory pointers during error...
ROOT-APP-NPM-CVE-2026-87776 CVE-2026-87776 in compression - Patched by Root
Root has patched CVE-2026-87776 in the compression package for Root:npm. Multiple fixed versions available...
CVE-2026-91135
A flaw was found in Apache Thrift. A remote attacker can exploit a heap-based buffer overflow in the C++ transport component to achieve arbitrary code execution or cause a Denial of Service DoS through an application crash. The vulnerability occurs when an application enables compression transfor...
Use After Free
Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...