EUVD-2026-83858

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

CVE-2026-9375

urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API preloadcontent=False when using Brotli support. The issue arises due to three independent code paths in response.py that bypass the maxlength protection introduced in version 2.6.0 to mitigate CVE-2025-66471...

Denial Of Service (DoS)

github.com/tendermint/tendermint is vulnerable to Denial Of Service DoS. The vulnerability is due to the makeHTTPClient function within httpclient.go automatically decompressing Gzip-compressed responses, without limitations on the size or content of the response body. This allows an attacker to...