CVE-2026-53716

A flaw was found in Envoy Gateway. A remote attacker, by providing a specially crafted compressed WebAssembly Wasm payload through a tenant-controlled URL, can exploit a vulnerability where the system decompresses the gzip file without limiting the output size. This can lead to an uncontrolled...

Rocky Linux 10.2 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc Multiple Vulnerabilities (crlsa-2026_67147)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service...

Rocky Linux 9 [CIQ] Security Update: python-tornado-debugsource / python3-tornado / etc Multiple Vulnerabilities (crlsa-2026_67146)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667146 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service via...

BIT-ENVOY-GATEWAY-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...

RLSA-2026:67146 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

RLSA-2026:67147 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RockyLinux 9 : python-tornado (RLSA-2026:67146)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67146 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service v...

RockyLinux 10 : python-tornado (RLSA-2026:67147)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service...

AlmaLinux 10 : python-tornado (ALSA-2026:67147)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service v...

AlmaLinux 9 : python-tornado (ALSA-2026:67146)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67146 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service vi...

CVE-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...

CVE-2026-53716

Envoy Gateway (open-source application gateway managing Envoy Proxy) has an unbounded gzip decompression vulnerability in getFileFromGZ within internal/wasm/httpfetcher.go. The function calls io.ReadAll on a gzip.Reader without limiting the decompressed output size. When a tenant-controlled Envoy...

CVE-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...

CVE-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...

CVE-2026-53659

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...

CVE-2026-53659 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...

CVE-2026-53659 http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small...

CVE-2026-53659

http4k is a functional Kotlin HTTP toolkit. The vulnerability (CWE-409) exists in ServerFilters.GZip , RequestFilters.GunZip , and the underlying gzip decompression functions, which imposed no cap on decompressed size . An unauthenticated client can send a small gzip-encoded request body that exp...