PSF-2026-39

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

CVE-2026-15310

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

EUVD-2026-65519

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

CVE-2026-15310

This vulnerability affects Python's zipfile module, specifically the decompression path for bzip2, LZMA, and Zstandard compressed members. The root cause is that these decompression routines use an attacker-controlled size to pre-allocate memory without a max_length bound , effectively defeating ...

CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

BIT-KEYCLOAK-2026-2575 Keycloak: keycloak: denial of service due to excessive samlrequest decompression

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...

RHEL 9 : python-urllib3 (RHSA-2026:59409)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59409 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

PT-2026-81324

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description When decompressing crafted zip files using bzip, LZMA, or Zstandard compressions, the software may use an attacker-controlled size to pre-allocate memory, which can lead to memory exhaustion...

PT-2026-81903

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploade...

TencentOS Server 4: pacemaker (TSSA-2026:0865)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0865 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-68516

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the...

CVE-2026-74723

A flaw was found in the Linux kernel. A local attacker could craft a btrfs image with a malformed LZO compressed file extent. This could lead to an out-of-bounds read during decompression, potentially causing a denial of service...

CVE-2026-53524

A flaw was found in WeeChat. An authenticated user of the relay module's WebSocket functionality can send a small compressed frame that, when decompressed, expands to a significantly larger size. This "decompression bomb" can exhaust all available server memory, leading to a Denial of Service DoS...

CVE-2026-70635

A flaw was found in TimescaleDB. Authenticated attackers with direct data manipulation language DML access to a compressed hypertable can exploit an out-of-bounds read vulnerability. By supplying a specially crafted Simple8b selector-11 value, attackers can bypass index validation checks during...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filteredbuf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...