AlmaLinux 9.2 [TuxCare] Security Update: python3.11-urllib3 Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1770035896)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770035896 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11-urllib3 Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1770046658)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770046658 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the...

PT-2026-103795

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.9 Description A memory accumulation issue exists in the CurlAsyncHTTPClient component. Remote attackers can trigger a denial of service by sending a gzip-encoded decompression bomb, which is a highly compressed fi...

AlmaLinux 9.2 [TuxCare] Security Update: gzip (ALMALINUX9.2:CLSA-2026:1786976234)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786976234 advisory. - GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state...

AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790063765)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790063765 advisory. - A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression...

adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...

GHSA-C6FG-446Q-CG94 adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path

Summary adm-zip enforces a maxOutputLength guard against decompression bombs on its synchronous getData path, but the equivalent asynchronous getDataAsync path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An application...

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)

NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process DoS vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

GHSA-RCW4-F5RP-G42V adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

Affected package: adm-zip npm Affected version: 0.6.0 Summary The fix shipped for CVE-2026-39244 methods/inflater.js caps zlib's decompression output via maxOutputLength: expectedLength, where expectedLength is read directly from the ZIP entry's attacker-controlled "uncompressed size" header fiel...

NPM: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

NPM: adm-zip: Decompression-bomb protection fix for CVE-2026-39244 can be bypassed by declaring uncompressed size as 0 vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

Affected package: adm-zip npm Affected version: 0.6.0 Summary The fix shipped for CVE-2026-39244 methods/inflater.js caps zlib's decompression output via maxOutputLength: expectedLength, where expectedLength is read directly from the ZIP entry's attacker-controlled "uncompressed size" header fiel...

EUVD-2026-71634

undici vulnerable to Denial of Service via unbounded decompression of compressed responses...

NPM: undici vulnerable to Denial of Service via unbounded decompression of compressed responses

NPM: undici vulnerable to Denial of Service via unbounded decompression of compressed responses vulnerability discovered by ? in WordPress Npm undici versions = 7.15.0, 7.29.1...

CVE-2026-68911

A flaw was found in nicotine-plus. A remote attacker can trigger a Denial of Service DoS by sending specially crafted, zlib-compressed peer messages containing a decompression bomb. When the recipient client decompresses the message, it exhausts available operating system memory, causing the...

CVE-2026-97688

A flaw was found in urllib3. A malicious server can trigger a Denial of Service DoS by returning a specially crafted compressed response containing trailing bytes. When streaming the response in chunks, the decompression logic can enter an infinite loop by repeatedly processing unconsumed data...

CVE-2026-68911

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

EUVD-2026-88978

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...

CVE-2026-68911

The Nicotine+ graphical client for the Soulseek peer-to-peer network is vulnerable to a decompression bomb in versions prior to 3.3.11 . A modified remote client can send zlib-compressed peer messages that, when processed, exhaust the recipient's operating system memory. This issue has been addre...

CVE-2026-68911 Nicotine+: Decompression of peer messages can exhaust available memory

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version...