CVE-2026-119549 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...

CVE-2026-119549 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...

CVE-2026-111924

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

CVE-2026-111924

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

EUVD-2026-103292

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during...

PT-2026-116493

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.83.0 Description An issue exists where unauthenticated attackers can cause a denial of service by exhausting server memory. This is achieved by sending small, highly compressed request bodies using the Content-Encodin...

PYSEC-2026-4209 Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Summary When docling detects the input format of a gzip-compressed tar archive METS-GBS, and later when the METS-GBS backend opens it, it calls tarfile.TarFile.getmembers. That builds the full member list in memory before the maxmembercount limit is checked. A small archive with a very large numb...

CVE-2026-109380

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

EUVD-2026-97878

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

CVE-2026-109380

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

PT-2026-110929

🚨 CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks...

CVE-2026-109380: Improper Validation of Specified Quantity in Input

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal. Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar that buffers chunks indefinitely, exhausting...

GHSA-3CR3-8M4C-FPXW Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Summary When docling detects the input format of a gzip-compressed tar archive METS-GBS, and later when the METS-GBS backend opens it, it calls tarfile.TarFile.getmembers. That builds the full member list in memory before the maxmembercount limit is checked. A small archive with a very large numb...

CVE-2026-59932

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-44981

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login to decompress unauthenticated gzip-compressed...

CVE-2026-15747: Observable Response Discrepancy

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...

CVE-2025-66214

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/storage and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable conten...

CVE-2025-66214 Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/storage and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable conten...

EUVD-2025-202310

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/storage and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable conten...

CVE-2025-66214: Deserialization of Untrusted Data

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/storage and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable conten...