DEBIAN-CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

AZL-104828 CVE-2026-98067 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

UBUNTU-CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

EUVD-2026-86720

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

CVE-2026-98067

The Linux kernel 's erofs filesystem was found to have a broken optimization where LZ4 rolling decompression could compromise data correctness. This occurred because the upstream LZ4 implementation might copy long literals backward on x86 systems, violating the rolling window assumption. To ensur...

CVE-2026-98067 erofs: disable LZ4 rolling decompression for now

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

CVE-2026-98067 erofs: disable LZ4 rolling decompression for now

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

Linux Distros Unpatched Vulnerability : CVE-2026-98067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, i...

CVE-2026-98067: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

CVE-2026-98067

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

PT-2026-98730

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

CVE-2026-65827

The open-source collaborative wiki software Docmost is vulnerable to a denial of service via an unbounded ZIP decompression (zip-bomb) in the page-import feature. In versions 0.21.0 through 0.95.0 , an authenticated workspace member with edit rights can upload an archive that lacks limits on tota...

CVE-2026-67232

A flaw was found in the rabbitmqwebmqtt plugin of RabbitMQ. An unauthenticated remote attacker can exploit a decompression bomb vulnerability by sending a highly-compressed WebSocket frame. This frame, when decompressed, inflates to gigabytes of memory, leading to a Denial of Service DoS by...

CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

GHSA-5VJJ-2R48-Q622 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, ...

GHSA-6CP7-3M3C-5X5C Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Impact Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed...