CVE-2026-82864

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method. An attacker can supply a crafted PDF with a FlateDecode stream containing a decompression bomb, causing a small compressed file to decompress to hundreds of megabytes. ...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

EUVD-2026-68399

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

Medium: python-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

RHEL 9 : gzip (RHSA-2026:61623)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61623 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

Medium: python3.13-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

ALSA-2026:61623 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

ALSA-2026:61625 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-2089)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2089 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Amazon Linux 2023 : python3.12-pip, python3.12-pip-wheel (ALAS2023-2026-2091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2091 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

Medium: python3.11-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

CVE-2026-82864: Improper Handling of Highly Compressed Data (Data Amplification)

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2026-2090)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2090 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

PT-2026-83741

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

Medium: python3.12-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-2092)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2092 advisory. Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions...

RHEL 10 : gzip (RHSA-2026:61625)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61625 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

CVE-2026-81319

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-81319

CVE-2026-81319 is a deserialization of untrusted data flaw in ash_cloak (an Erlang/BEAM encryption library by ash-project), affecting versions 0.1.0 through before 0.4.0 . The root cause is that AshCloak.Calculations.Decrypt decodes the decrypted binary using Ash.Helpers.non_executable_binary_to_...