CVE-2026-47321 Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

CVE-2026-47321

Apache MINA's CompressionFilter uses ZLib to inflate incoming data without bounding the resulting size. An attacker can send a small compressed payload with a compression ratio exceeding 1,000× , exhausting application memory and causing a denial of service (CVSS 3.1: 7.5 HIGH , impact: availabil...

PT-2026-85149

Vulnerability Details File: lib/compressed protocol.js Line: 43 zlib.inflatebody, err, data = ... inside handleCompressedPacket Root Cause When a connection is created with compress: true and the server advertises CLIENT COMPRESS, every incoming packet is unwrapped by handleCompressedPacket in...