Medium: fence-agents

Issue Overview: httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server t...

CVE-2026-109226: Improper Handling of Highly Compressed Data (Data Amplification)

SGLang through 0.5.21 contains a decompression amplification vulnerability in loadaudio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audiourl or audioda...

EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-4063)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer overflow guard inside the if masked block, leaving unmasked...

gd security update

2.3.3-20.1 - Fix LZW decompression in GIF handling CVE-2026-9672 Resolves: RHEL-259570...

mongobleed

mongobleed CVE-2025-14847 - Explotación de fuga de memoria no autenticada en MongoDB Un exploit de prueba de concepto para la vulnerabilidad de descompresión zlib de MongoDB que permite a atacantes no autenticados filtrar memoria sensible del servidor. Vulnerabilidad Un fallo en la descompresión...

CVE-2026-108750

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

CVE-2026-108750

The OpenDocMan application versions 2.4.0 through 2.10.0 is vulnerable to a decompression bomb (CWE-409) during the upload text extraction process. This flaw allows authenticated users to exhaust PHP memory by uploading small, specially crafted ODT, DOCX, or XLSX files. When processed, the XML en...

CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

EUVD-2026-96915

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...

pyxamstore

Explorador de Xamarin AssemblyStore pyxamstore Esta es una versión alfa de un analizador de assemblies.blob AssemblyStore escrito en Python. La herramienta es capaz de desempaquetar y reempaquetar archivos assemblies.blob y assemblies.manifest de Xamarin desde un APK. Instalación Ejecute el scrip...

PT-2026-110152

Name of the Vulnerable Software and Affected Versions OpenDocMan versions 2.4.0 through 2.10.0 Description Authenticated users can cause a denial of service by uploading specially crafted office documents ODT, DOCX, or XLSX. These files utilize a decompression bomb technique, where small XML...

CVE-2026-108750: Improper Handling of Highly Compressed Data (Data Amplification)

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers...

GHSA-W7JP-MF2V-8342 Vikunja: Denial of service via decompression bomb in the data import

Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Because the archive is...

Vikunja: Denial of service via decompression bomb in the data import

Summary Vikunja lets you export your data as a zip and import it back. The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it. Because the archive is...

CVE-2026-78384

A vulnerability exists in Apache CXF (specifically the org.apache.cxf:cxf-core component) where the CompressionUtils.inflate() function fails to enforce an output-size cap when decompressing DEFLATE data. A remote attacker can exploit this by submitting a small, crafted payload that expands into ...

CVE-2026-78384 Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...

WS-2026-0157

vllm 0.10.2 - 0.24.0: the Nemotron-VL processor modules set Image.MAXIMAGEPIXELS = None at import, disabling Pillow's decompression-bomb guard process-wide so a crafted image can exhaust worker memory GHSA-mm38-5g96-7j6x...

PT-2026-108816

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The CompressionUtils.inflate function decompresses attacker-controlled DEFLATE data without an output-size cap, allowing a...