Astra Linux – Vulnerability in Golang-github-dvsekhvalnov-jose2go

A vulnerability was discovered in dvsekhvalnov jose2go versions 1.5.0 through 1.7.0. This vulnerability allows an attacker to trigger a Denial-of-Service DoS attack by using a specially crafted JSON Web Encryption JWE token with an exceptionally high compression ratio...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: erofs: Fix inconsistent per-file compression format EROFS can select compression algorithms on a per-file basis. Each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However,...

Astra Linux – Vulnerability in nghttp2

nghttp2 is an implementation of the Hypertext Transfer Protocol Version 2 in C. The nghttp2 library prior to version 1.61.0 continued to read an unlimited number of HTTP/2 CONTINUATION frames even after a stream was reset, in order to keep the HPACK context synchronized. This caused excessive CPU...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder, an out-of-bounds write vulnerability could occur due to a missing check. This issue has been fixed in versions...

Astra Linux – Vulnerability in zlib, libz-mingw-w64

Before version 1.2.12, zlib allowed memory corruption during deflation i.e., when compressing if the input contained many distant matches...

EUVD-2026-77370

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...

SUSE-SU-2026:4151-1 Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: - CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431...

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

PT-2026-91148

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via improper cleanup of the zlib compression stream when a client disconnects before the response finishes. The onResponseClose handler was absent, leaving native zlib handles unrelease...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via improper cleanup of the zlib compression stream when a client disconnects before the response finishes. The onResponseClose handler was absent, leaving native zlib handles unrelease...

CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

AZL-101778 CVE-2026-87776 affecting package python-tensorboard 2.16.2-6

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

DEBIAN-CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

UBUNTU-CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776

A flaw was found in the compression Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

EUVD-2026-76072

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...