RHLW-2026-2CB9A31C02A7F38B Lightwell Security Advisory: mina-filter-compression 2.2.5.rhlw-00008

Red Hat Lightwell has released org.apache.mina:mina-filter-compression 2.2.5.rhlw-00008 with a backported security fix. CVE-2026-47321: The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting siz...

Astra Linux – Vulnerability in zlib, libz-mingw-w64

Zlib versions up to 1.2.12 have a heap-based buffer over-read or buffer overflow issue in the inflate function within inflate.c, due to a large gzip header extra field. NOTE: Only applications that call inflateGetHeader are affected. Some common applications bundle the affected Zlib source code,...

CVE-2026-110927

Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585...

UBUNTU-CVE-2026-110927

Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585...

CVE-2026-110927

Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585...

CVE-2026-110927

...

CVE-2026-110927

...

CVE-2026-110927

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...

CVE-2026-110927

A flaw exists in OpenSSH where a compressed payload can expand beyond the maximum supported packet size during connection handling. This occurs because the inflate loop fails to terminate at the established limit, causing memory usage to grow in the process managing the connection. Exploitation d...

EUVD-2026-102055

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...

CVE-2026-110927

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...

CLEANSTART-2026-TX86596 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

CVE-2026-85024 affects multiple packages. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. See references for individual vulnerability details...

PT-2026-114930

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description An issue exists where a compressed payload can expand beyond the maximum supported packet size after compression is negotiated. This occurs because the inflate loop does not stop at the defin...

Linux Distros Unpatched Vulnerability : CVE-2026-110927

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop do...

CVE-2026-110927: Allocation of Resources Without Limits or Throttling

Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585...

OpenSSH resource management error vulnerabilities

OpenSSH has a resource management vulnerability. This vulnerability arises from the inflate loop not being stopped at the maximum supported data packet size after negotiation and compression. As a result, the compressed payload can expand beyond this limit, causing an increase in memory usage for...

openssh: openssh: a compressed payload can expand past the maximum packet size

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection...

CLEANSTART-2026-VB20350 undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still ...

CVE-2026-85024 affects multiple packages. undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. See references for individual vulnerability details...

Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the ExrDecoderCore process when handling ZIP-compressed OpenEXR images. An attacker can access sensitive memory contents from prior operations by submitting a crafted image...

CVE-2026-106111 ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the fu...