249 matches found
CVE-2026-15310
A flaw was found in Python. When decompressing specially crafted zip files that use bzip, LZMA, or Zstandard compression methods, Python may pre-allocate memory based on an attacker-controlled size. This could lead to excessive memory consumption, potentially causing a Denial of Service DoS for t...
Astra Linux – Vulnerability in libzstd
Starting from v1.4.1 and before v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and then restricted those permissions immediately afterwards. As a result, the output files could temporarily be readable or writab...
AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1791377791)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791377791 advisory. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-alloca...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
CLEANSTART-2025-JH01650 race condition in the one-pass compression functions of Zstandard prior to version 1
Security vulnerability affects the zstd package. A race condition in the one-pass compression functions of Zstandard prior to version 1...
CLEANSTART-2025-NH78236 In the Zstandard command-line utility prior to v1
Security vulnerability affects the zstd package. In the Zstandard command-line utility prior to v1...
Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789993238)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789993238 advisory. - When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
OESA-2026-3920 python3 security update
Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...
rsync: rsync: Denial of Service via Zstandard compression thread exhaustion
A denial-of-service flaw in rsync allows remote attackers to exhaust system memory and CPU. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads...
Astra Linux – Vulnerability in libzstd
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. The correct file permissions matching the input would only be set at the time of completion. As a result, output files could be readable or writable by unintended parties...
BIT-LIBPYTHON-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...
netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...
Data Amplification
Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Data Amplification in the default transport's response decompression, which inflates each network read of up to 64 KiB completely into a single intermediate allocation before yielding any...
python: Python: Denial of Service via crafted zip file memory pre-allocation
A flaw was found in Python. When decompressing specially crafted zip files that use bzip, LZMA, or Zstandard compression methods, Python may pre-allocate memory based on an attacker-controlled size. This could lead to excessive memory consumption, potentially causing a Denial of Service DoS for t...
python: Python: Denial of Service via crafted zip file memory pre-allocation
A flaw was found in Python. When decompressing specially crafted zip files that use bzip, LZMA, or Zstandard compression methods, Python may pre-allocate memory based on an attacker-controlled size. This could lead to excessive memory consumption, potentially causing a Denial of Service DoS for t...
python: Python: Denial of Service via crafted zip file memory pre-allocation
A flaw was found in Python. When decompressing specially crafted zip files that use bzip, LZMA, or Zstandard compression methods, Python may pre-allocate memory based on an attacker-controlled size. This could lead to excessive memory consumption, potentially causing a Denial of Service DoS for t...
python: Python: Denial of Service via crafted zip file memory pre-allocation
A flaw was found in Python. When decompressing specially crafted zip files that use bzip, LZMA, or Zstandard compression methods, Python may pre-allocate memory based on an attacker-controlled size. This could lead to excessive memory consumption, potentially causing a Denial of Service DoS for t...