tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

RHEL 9 : resteasy (RHSA-2026:95504)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95504 advisory. RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully...

CVE-2026-112899 Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive...

CVE-2026-112899 Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive...

CVE-2026-112899

The Pillow Python imaging library (versions 2.3.0 through 12.3.0 ) contains a flaw where the EPS image loader fails to validate scaled image dimensions before invoking Ghostscript . An attacker can provide a crafted EPS file that forces the rendering process to generate excessively large temporar...

EEF-CVE-2026-119434 Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...

CVE-2026-102467

A flaw was found in Eclipse Vert.x. The WebSocket implementation does not limit memory allocation when decompressing incoming frames or messages. A remote attacker can exploit this vulnerability by sending a compressed payload designed to expand into an excessively large size a decompression bomb...

resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...

Important: Red Hat Security Advisory: dogtag-pki security update

An update for dogtag-pki is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2026-112899

A flaw was found in Pillow. The Encapsulated PostScript EPS image loader only validates decompression bomb limits against the unscaled dimensions defined in the file, rather than the final scaled dimensions requested during rendering. An attacker can exploit this issue by providing a crafted EPS...

EulerOS Virtualization 2.13.0 : brotli (EulerOS-SA-2026-1626)

According to the versions of the brotli package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Scrapy versions up to 2.13.2 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Denial-of-service exploit for Sliver C2's HTTPS listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory. Published as GHSA-663m-7x7m-g4fw. Summary Sliver's HTTPS C2 channel wraps messages inside PNG images...

Fedora 45 : rust-backtrace / rust-object / rust-object0.37 / rust-object0.38 / etc (2026-e10e41c5b3)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-e10e41c5b3 advisory. - Update the object crate to version 0.40.0. - Add a compat package for version 0.39 of the object crate. - Update the ruzstd crate to version 0.9.1. This...

GHSA-8FMV-6RG5-5924 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

RockyLinux 10 : dogtag-pki (RLSA-2026:92408)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

AlmaLinux 10 : dogtag-pki (ALSA-2026:92408)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92408 advisory. resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode Decompression-Bomb DoS CVE-2026-89059 resteasy-core: RESTEasy: CorsFilter Reflects...

CVE-2026-118761 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar...

CVE-2026-118761 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar...