NPM: compression vulnerable to Denial of Service via memory leak on premature response close

NPM: compression vulnerable to Denial of Service via memory leak on premature response close vulnerability discovered by ? in WordPress Npm compression versions 1.8.2...

EUVD-2026-76072

compression vulnerable to Denial of Service via memory leak on premature response close...

01basicreact (>=0.1.0, <=0.1.9), 10by10-react-app (1.2.1) +6183 more potentially affected by CVE-2026-87776 via compression (>=1.0.0, <=1.8.1)

compression NPM version =1.0.0, =0.1.0, =0.30.0, =4.11.0, =0.0.0-canary.0, =0.0.1, =2.0.1, =0.1.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-87776 Source advisory: GHSA-VC2V-76PW-4V95...

compression vulnerable to Denial of Service via memory leak on premature response close

Impact A vulnerability in compression 1.8.2 allows an attacker to trigger a Denial of Service DoS by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, s...

GHSA-VC2V-76PW-4V95 compression vulnerable to Denial of Service via memory leak on premature response close

Impact A vulnerability in compression 1.8.2 allows an attacker to trigger a Denial of Service DoS by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, s...

01basicreact (>=0.1.0, <=0.1.9), 10by10-react-app (1.2.1) +6183 more potentially affected by CVE-2026-87776 via compression (>=1.0.0, <=1.8.1)

compression NPM version =1.0.0, =0.1.0, =0.30.0, =4.11.0, =0.0.0-canary.0, =0.0.1, =2.0.1, =0.1.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-87776 Source advisory: OSV:GHSA-VC2V-76PW-4V95...

Astra Linux – Vulnerability in curl

curl 7.84.0 supports “chained” HTTP compression algorithms, which means that a server response can be compressed multiple times, possibly using different algorithms. The number of allowable “links” in this “decompression chain” is unlimited, allowing a malicious server to insert virtually an...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: does not allow unaligned truncation on released compress inode An F2FS image may become corrupted after performing the following test cases: - mkfs.f2fs -O extraattr,compression -f /dev/vdb - mount /dev/vdb...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: flowdissector: Do not dissect PPPoE PFC frames. RFC 2516, Section 7 states that Protocol Field Compression PFC is NOT recommended for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow...

Indistinguishability Lifting for Keyed Oracles, Compressed Ideal Cipher, and More Applications

Cryptographic security proofs often involve an adversary interacting with a larger, keyed oracle that consists of potentially exponentially many independent instances of a smaller, base oracle. However, showing quantum indistinguishability between two such keyed oracles can be tricky, since a...

CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (ALMALINUX9.2:CLSA-2025:1736503760)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736503760 advisory. - NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs t...

Rocky Linux 9 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2025_8197)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258197 advisory. unbound: Unbounded name compression could lead to Denial of Service CVE-2024-8508 Tenable has extracted the preceding description block directly from the CIQ securi...

CentOS Linux 8 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs (CENTOS-STREAM8:CLSA-2026:1790264021)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1790264021 advisory. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and...

Rocky Linux 8 [CIQ] Security Update: httpd / httpd-debuginfo / httpd-debugsource / httpd-devel / etc (crlsa-2026_25090)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625090 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc (crlsa-2023_1140)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20231140 advisory. curl: HTTP multi-header compression denial of service CVE-2023-23916 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc (ALMALINUX9.6:CLSA-2026:1790264968)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790264968 advisory. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and...

Rocky Linux 10.0 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc (crlsa-2025_8047)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258047 advisory. unbound: Unbounded name compression could lead to Denial of Service CVE-2024-8508 Tenable has extracted the preceding description block directly from the CIQ...

CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python (CENTOS7:CLSA-2025:1765997462)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1765997462 advisory. - NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to...

Rocky Linux 9 [CIQ] Security Update: mod_http2 / mod_http2-debuginfo / mod_http2-debugsource (crlsa-2026_25057)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202625057 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block direct...