42 matches found
keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...
keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...
keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...
keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...
NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
NPM: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process DoS vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
NPM: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression vulnerability discovered by ? in WordPress Npm undici versions = 6.25.0, 6.28.1...
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
Summary SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage...
GHSA-3W98-RRPR-FPRR HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
Summary SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage...
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collectio...
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collectio...
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collectio...
CVE-2026-81875
HAPI FHIR (a Java HL7 FHIR interoperability library) is vulnerable to a denial-of-service via its SHCParser component. When processing attacker-controlled Smart Health Card JWTs containing a zip: "DEF" header with a small raw-DEFLATE payload, the inflate() and decompress() methods accumulate deco...
CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...
BIT-KEYCLOAK-2026-2575 Keycloak: keycloak: denial of service due to excessive samlrequest decompression
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...
CVE-2026-73232
ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...
GHSA-J5G9-F88F-GFJ3 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...
SUSE CVE-2026-59939
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...
CVE-2026-59939 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small...
PYSEC-2026-1202 Authlib : JWE zip=DEF decompression bomb enables DoS
Summary Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. Details - Affected component...
Authlib : JWE zip=DEF decompression bomb enables DoS
SummaryAuthlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. Details- Affected component:...