CVE-2026-101894

CVE-2026-101894 — @xhmikosr/decompress symlink-chain path traversal Python 3 PoC for CVE-2026-101894 — Node.js archive extraction in @xhmikosr/decompress and unmaintained decompress allows read/write outside the output directory via a chain of symlink entries. Bypass of CVE-2026-53486 hardening...

CVE-2026-118261

A flaw was found in Echo's Decompress middleware. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending small, compressed requests that expand into excessively large payloads upon decompression. Because the middleware does not enforce a limit on the expanded data...

CVE-2026-110641

A flaw was found in @runnerty/executor-decompress. An attacker can achieve arbitrary command execution by supplying a crafted archive file name containing shell metacharacters to a monitored directory. Because the application fails to properly sanitize file names before passing them to the system...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

PT-2026-135468

Name of the Vulnerable Software and Affected Versions libgphoto2 versions prior to 2.5.35 Description A heap out-of-bounds read and write issue exists in the jl2005bcd decompress function. This occurs when processing oversized thumbnails from malicious USB cameras. By providing small...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-61725 sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CLEANSTART-2026-ZL68520 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

Security vulnerability affects the renovate package. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header...

PT-2026-134231

Name of the Vulnerable Software and Affected Versions sevenz-rust2 versions prior to 0.21.1 Description Extracting a malicious 7z archive allows writing or overwriting files outside the intended destination directory. In src/util/decompress.rs, the decompress impl function calculates the...

CVE-2026-61725: hasenbanck sevenz-rust2: sevenz-rust2 is a Rust-native 7z compressor and `decompress`or

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

Linux Distros Unpatched Vulnerability : CVE-2026-118261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded...

DEBIAN-CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...

UBUNTU-CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...

CVE-2026-118261 Echo: Decompress permits unbounded gzip expansion in v4

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...

CVE-2026-118261

The Echo Go web framework (v4) is vulnerable to a denial of service (DoS) via unbounded gzip expansion in the opt-in Decompress middleware . In versions 4.0.0 through 4.16.0 , the middleware exposes a decoded request stream without limiting its expanded size. A small compressed request can expand...

EUVD-2026-112370

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...

CVE-2026-118261 Echo: Decompress permits unbounded gzip expansion in v4

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU an...