5518 matches found
GHSA-XV9W-7V6Q-HPJH fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`
The fluent-plugin-s3 plugin specifically the ins3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limit...
GHSA-J9CW-HWQF-85W7 Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
Fluentd's inhttp and inforward plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming compressed payloads e.g., via bodysizelimit or chunksizelimit, it was discovered that there is no limit enforced on the size of the decompressed data. If a...
PT-2026-53004
Name of the Vulnerable Software and Affected Versions Fluentd versions prior to 1.19.3 Description The in http and in forward plugins support gzip-compressed data but only enforce size limits on the compressed payloads via settings like body size limit and chunk size limit. Because no limit is...
PT-2026-53007
The fluent-plugin-opentelemetry plugin specifically the in opentelemetry HTTP input lacked strict size limits on incoming requests. It was discovered that the plugin read the entire request body and decompressed payloads into memory without enforcing maximum size thresholds. If the OpenTelemetry...
PT-2026-60346
Name of the Vulnerable Software and Affected Versions 7-Zip versions prior to 26.02 Description A heap-based buffer overflow exists in the XZ decompression component, specifically within the MixCoder Code function. This issue occurs during the processing of XZ chunked data when the decoder fails ...
PT-2026-53006
The fluent-plugin-s3 plugin specifically the in s3 input plugin supports reading and decompressing heavily compressed files such as gzip, lzma2, and lzop from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limi...
GO-2026-5609 OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) in github.com/openbao/openbao
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction DoS in github.com/openbao/openbao...
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Description The Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing maxapkmetadatasize check default 1MB is only applied to individual tar entry...
GHSA-47Q9-M4WW-924M Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Description The Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing maxapkmetadatasize check default 1MB is only applied to individual tar entry...
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Summary When MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small paylo...
CVE-2026-54250
CVE-2026-54250 affects K3s by a ZIP archive path traversal in the etcd snapshot decompression. Before versions 1.35.3+k3s1, 1.34.6+k3s1, and v1.33.10+k3s1, a crafted ZIP member can be written to arbitrary filesystem locations when restoring an etcd snapshot, due to the decompression process. Impa...
CVE-2026-54250 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...
CVE-2026-54278
A flaw was found in aiohttp, an asynchronous HTTP client/server framework. An attacker could send a specially crafted compressed request body that, during cleanup, would be decompressed into memory in one large chunk. This could potentially lead to a Denial of Service DoS condition, where the...
CVE-2026-54448
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to...
CVE-2026-54448
CVE-2026-54448 affects Trivy. Prior to version 0.71.0, its Helm chart scanner uses a custom tar unpacker that reads each archive entry with io.ReadAll(tr) without a size limit, enabling a malicious .tgz to decompress to gigabytes and trigger the OS OOM killer. This could cause the Trivy process t...
grok:grk_decompress_fuzzer: Heap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre
Project: https://github.com/GrokImageCompression/grok.git https://github.com/GrokImageCompression/grok-test-data.git Detailed Report: https://oss-fuzz.com/testcase?key=6266225987223552 Project: grok Fuzzing Engine: libFuzzer Fuzz Target: grkdecompressfuzzer Job Type: libfuzzerasangrok Platform Id...
perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob
A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of...
EUVD-2026-39223
In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi-syncdecompress zerofsdecompresskickoff can race with filesystem unmount, causing a use-after-free on sbi-syncdecompress. When I/O completes, zerofsendio calls zerofsdecompresskickoff to queue...
CVE-2026-53272
The CVE-2026-53272 issue affects the Linux kernel’s erofs subsystem. A use-after-free on sbi->sync_decompress can occur when z_erofs_endio() queues z_erofs_decompressqueue_work() and, after folios are unlocked, the unmount path completes with sbi freed before sbi->sync_decompress is accesse...
CVE-2026-53272
In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi-syncdecompress zerofsdecompresskickoff can race with filesystem unmount, causing a use-after-free on sbi-syncdecompress. When I/O completes, zerofsendio calls zerofsdecompresskickoff to queue...