GHSA-8CP2-47HG-MFGH Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core IIS out-of-process hosting and request decompression. This advisory also provides...

Moderate: Red Hat Security Advisory: gzip security update

An update for gzip is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

gzip: gzip: Information disclosure via global buffer overflow in LZH decompression

A flaw was found in GNU gzip. This global buffer overflow vulnerability in the LZH decompression logic is caused by improper reuse of shared global state between different decompression formats. An attacker can exploit this by providing a specially crafted LZW file followed by a specially crafted...

undici: undici: Denial of Service via unbounded decompression of compressed responses

A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands...

EUVD-2026-74294

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

ALSA-2026:65998 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

RHEL 8 : gzip (RHSA-2026:65998)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65998 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

CVE-2026-18090

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

AZL-100929 CVE-2026-18090 affecting package gdk-pixbuf2 2.42.10-6

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

DEBIAN-CVE-2026-18090

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

CVE-2026-18090

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image .icns file. The uncompress function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during...

CVE-2026-18090

A heap out-of-bounds read vulnerability was identified in gdk-pixbuf , specifically in the uncompress() function that handles RLE-encoded Apple Icon Image (.icns) data. The function fails to validate the source buffer's boundaries during decompression, allowing a local attacker who supplies a cra...

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

GHSA-8XX6-HGC6-GC2M HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

Data Amplification

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Data Amplification in the default transport's response decompression, which inflates each network read of up to 64 KiB completely into a single intermediate allocation before yielding any...

EulerOS 2.0 SP12 : gzip (EulerOS-SA-2026-3266)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3353)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

NewStart CGSL MAIN 7.02 : python-urllib3 Multiple Vulnerabilities (NS-SA-2026-0104)

The remote NewStart CGSL host, running version MAIN 7.02, has python-urllib3 packages installed that are affected by multiple vulnerabilities: - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly...

EulerOS 2.0 SP12 : python-pillow (EulerOS-SA-2026-3300)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when giv...