CVE-2026-53524 WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

CVE-2026-53524

WeeChat versions 4.3.0 through 4.9.0 contain a decompression bomb vulnerability in the relay module's WebSocket permessage-deflate decompression function (relay_websocket_inflate()). The function imposes no upper bound on output size, allowing an authenticated relay user to send a small compresse...

CVE-2026-53524

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

JetBrains YouTrack < 2026.2.18177 DoS (CVE-2026-75047)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18177. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via a decompression bomb in the import endpoint. CVE-2026-75047 Note that Nessus has not tested for this issue but...

CVE-2026-61690 Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...

CVE-2026-53524

GHSA-v2v4-45wm-5cr3: Decompression Bomb in Relay WebSocket DoS...

UBUNTU-CVE-2026-53524

GHSA-v2v4-45wm-5cr3: Decompression Bomb in Relay WebSocket DoS...

CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75047

JetBrains YouTrack before version 2026.2.18177 is vulnerable to a denial-of-service attack via a decompression bomb submitted to the import endpoint. A low-privileged authenticated user can trigger high availability impact (CVSS 6.5) without user interaction. Exploitation details are not provided...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

EUVD-2026-60246

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

PT-2026-76696

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-74767 Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

CVE-2026-74767 Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb

Pandora contains a denial-of-service vulnerability in its handling of DAA Direct Access Archive files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress without enforcing a limit on the resulting uncompressed data. An attacker abl...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...