CVE-2026-114605 dnspython dns.name.from_wire_parser() excessive CPU use

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application...

compression: compression: Denial of Service via memory leak on premature response close

A flaw was found in the compression Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for...

DEBIAN-CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

AZL-110534 CVE-2026-96405 affecting package unbound 1.26.1-1

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405

NLnet Labs Unbound versions up to and including 1.26.1 are vulnerable to a resource exhaustion issue. While the software limits compression-pointer traversal for individual domain-name operations, it lacks an aggregate inbound decompression-work budget . An attacker with recursive-query access an...

CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

EUVD-2026-107153

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious act...

Linux Distros Unpatched Vulnerability : CVE-2026-96405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inboun...

PT-2026-120515

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.2 Description NLnet Labs Unbound limits compression-pointer traversal for each individual domain-name operation but lacks an aggregate inbound decompression-work budget. A malicious actor with...

CVE-2026-107692

The War Thunder game client transmits its authentication bearer token authjwt in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the...

CVE-2026-107692 War Thunder Account Impersonation

The War Thunder game client transmits its authentication bearer token authjwt in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the...

CVE-2026-107692

The War Thunder game client is vulnerable to an account impersonation flaw because it transmits its authentication bearer token (auth_jwt) in the first data packet after the TCP handshake using only LZ4 compression without encryption. A network-positioned attacker can passively intercept and deco...

EUVD-2026-105305

The War Thunder game client transmits its authentication bearer token authjwt in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the...

CVE-2026-98079

A flaw was found in the Linux kernel's Btrfs file system. A local user could trigger a Denial of Service DoS when performing write operations on a file system using Zstandard zstd compression. Due to a synchronization timing issue during memory allocation, a write task can miss a wake-up...

NLnet Labs Unbound Resource Management Vulnerability

NLnet Labs Unbound versions 1.26.1 and earlier have a resource management vulnerability. This vulnerability stems from the lack of a overall budget limit on the incoming decompression workload. A large number of chained compression pointers can lead to excessive CPU usage. Attackers can exploit...

CLSA-2026-1792473778 TuxCare security update for compression (1 CVE)

TuxCare rebuilt compression to address 1 CVE. Fixed in 1.7.5-tuxcare.1...

CLSA-2026-1792473493 TuxCare security update for compression (1 CVE)

TuxCare rebuilt compression to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

PT-2026-118622

Name of the Vulnerable Software and Affected Versions War Thunder affected versions not specified Description The game client transmits the auth jwt authentication bearer token in the initial data packet following the TCP handshake. This transmission uses LZ4 compression—a lossless data compressi...