15 matches found
rsync: rsync: Denial of Service via Zstandard compression thread exhaustion
A denial-of-service flaw in rsync allows remote attackers to exhaust system memory and CPU. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads...
CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
...
CVE-2026-70455
A denial-of-service flaw in rsync allows remote attackers to exhaust system memory and CPU. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads. Mitigation If the rsync daemon is unused,...
CVE-2026-70455
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...
CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...
CVE-2026-64031
CVE-2026-64031 relates to the Linux kernel erofs module and fixes a managed cache race for unaligned extents in compressed data. The race could occur when two threads race to add the same folio to the managed cache (z_erofs_bind_cache) while folio->private is still Z_EROFS_PREALLOCATED_FOLIO. ...
PT-2026-60365
Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.32.8 Description Pomerium is an identity and context-aware access proxy. In hosted or stateless authentication deployments, the /.pomerium/callback endpoint is reachable without credentials and processes...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the HttpContentDecompressor and DelegatingDecompressorFrameListener components when the Content-Encoding header is set to br, zstd, or snappy. An attacker can exhaust...
CVE-2026-2219
It was discovered that dpkg-deb a component of dpkg, the Debian package management system does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service infinite loop spinning the CPU...
CVE-2026-2219
The dpkg-deb tool, a component of the dpkg package management system, contains a vulnerability where it fails to properly validate the end of the data stream when uncompressing zstd-compressed .deb archives . This flaw can be exploited by a remote attacker using a specially crafted archive to tri...
dpkg-deb 安全漏洞
dpkg-deb is a package manager in Linux developed by the Debian community. dpkg-deb has a security vulnerability that stems from improper validation of the end of the data stream when decompressing.deb archives compressed with zstd, which could lead to a denial-of-service attack...
EUVD-2019-3580
Malware in sbrugna...
ROS-20250114-12
A vulnerability in the implementation of the Zstandard compression method of the 7-Zip archiver is related to integer overflow. Exploitation of the vulnerability could allow an attacker to execute arbitrary code provided that a user opens a specially generated archive. by a user opening a special...
