CVE-2026-85786 Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

PT-2026-86241

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression...

EUVD-2026-56926

ffuf denial of service OOM via HTTP response decompression bomb...

Linux Distros Unpatched Vulnerability : CVE-2026-84382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip,...

CVE-2026-49855

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compressed frame that decompresses to gigabytes, exhausting the BEAM node's heap and triggering an OOM kill denial of service. Introduced in...

EUVD-2026-37014

gRPC Erlang package has unbounded gzip decompression decompression bomb...

[SECURITY] [DLA 4747-1] python-httplib2 security update

Debian LTS Advisory DLA-4747-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias August 20, 2026 https://wiki.debian.org/LTS Package : python-httplib2 Version : 0.18.1-3+deb11u1 CVE ID : CVE-2021-21240 CVE-2026-59939 Debian Bug : 982738 Two vulnerabilities were...

Debian dla-4747 : python3-httplib2 - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4747 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4747-1 [email protected]...

CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

EUVD-2026-61174

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue,...

CVE-2026-75936

Amazon ion-java before 1.12.0 is vulnerable to a memory-amplification denial of service in its GZIP auto-decompression handler . A remote attacker can supply a crafted compressed Ion document that expands to an arbitrarily large size upon decompression, exhausting memory and causing a DoS. The vu...

GHSA-G4W2-6H2R-3M3W http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

Impact ServerFilters.GZip and RequestFilters.GunZip and the underlying Gzip functions used to decompress request bodies did not impose any cap on the decompressed size. A small malicious gzip-encoded request body on the order of kilobytes could decompress to gigabytes, exhausting the JVM heap and...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702 Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size...

CVE-2026-48702

CVE-2026-48702 : Rekor before 1.5.2 decompresses APK signatures in Alpine APK parsing without bounding the total decompressed size, enabling a decompression bomb via gzip with extreme ratios. Attackers can trigger unbounded heap allocation during requests to unauthenticated endpoints POST /api/v1...

CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

UBUNTU-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

PT-2026-70893

Name of the Vulnerable Software and Affected Versions ffuf versions prior to 2.2.0 Description A malicious target server can trigger an out-of-memory denial of service. This occurs because the response size guard in the pkg/runner/simple.go file only verifies the compressed Content-Length, wherea...