EUVD-2026-104636

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS...

GHSA-VX6W-VV9F-6GVG Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

============================================================================ EPS loadscale lets Ghostscript render past the decompression bomb limit Location: src/PIL/EpsImagePlugin.py:92 in Ghostscript Commit: a707c6b21c313880d0771e54965d142dd42358b6...

CVE-2026-90797

Apache CouchDB versions 3.5.2 and below on all platforms are vulnerable to a pre-authentication gzip decompression bomb . The issue resides in the chttpd component, where an unlimited gzip decompression routine allows a remote client to trigger a denial of service (DoS) by causing memory exhausti...

CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

CVE-2026-90797 Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

resteasy security update

An update is available for resteasy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list RESTEasy contains a JBoss project that provides frameworks to help build...

DEBIAN-CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode...

ALSA-2026:85234 Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode...

resteasy security update

3.0.26-20.1 - Fix CVE-2026-89058: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config - Fix CVE-2026-89059: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS - Resolves: RHEL-278032 - Resolves: RHEL-277999...

PT-2026-117658

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile. seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Denial-of-service exploit for Sliver C2's HTTPS listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory. Published as GHSA-663m-7x7m-g4fw. Summary Sliver's HTTPS C2 channel wraps messages inside PNG images...

Rocky Linux 10.2 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82041)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...

MiracleLinux 9 : python-tornado-6.5.10-1.el9_8.1 (AXSA:2026-2053:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-2053:04 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block...

Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc (crlsa-2026_82040)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly fr...

RLSA-2026:82041 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...