CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- tandoor recipesTandoor Recipes Affected by Denial of Service via Recipe Import6.5 Medium
- mervinpraison praisonaiPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits6.5 Medium
- latchset jwcryptoJWCrypto: JWE ZIP decompression bomb5.3 Medium
- mattermost, mattermost server +1 moreZip Bomb Denial of Service via Unrestricted Archive Decompression6.5 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS Server panic via malicious compression on leafnode port7.5 High
- pdfme pdf-libpdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb7.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, single sign-on 7.6 for rhel 7 +5 more +7 moreKeycloak: keycloak: denial of service due to excessive samlrequest decompression5.3 Medium
- sindresorhus file-typefile-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry5.3 Medium
- erlang otp, erlang\/otp, erlang\/ssh +2 morePre-auth SSH DoS via unbounded zlib inflate6.9 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 High
- markusproject markusMarkUs: Zip bomb in config upload enables DoS6.5 Medium
- yhirose cpp-httplibPayload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib7.5 High
- openclawOpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation6.7 Medium
- psd-toolspsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps6.8 Medium
github.com/bishopfox/sliverGoSliver has Potential Zip Bomb Denial of Service in GzipEncoder7.7 High- linuxfoundation nats-servernats-server websockets are vulnerable to pre-auth memory DoS5.9 Medium
- obsidianforensics unfurlUnfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression8.7 High
- datadog guarddogGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS7.1 High
- yhirose cpp-httplibcpp-httplib vulnerable to a denial of service (DOS) using a zip bomb8.7 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)8.9 High
- aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 moreAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb7.5 High
- turms-im turmsTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial...7.5 High
- python-jose project python-joseDuplicate Advisory: python-jose denial of service via compressed JWE content5.3 Medium
- vercel next, next.js +1 moreNext.js has Unbounded Memory Consumption via PPR Resume Endpoint5.9 Medium
- python urllib3urllib3 Streaming API improperly handles highly compressed data8.9 High
- py-pdf pypdfpypdf manipulated LZWDecode streams can exhaust RAM6.6 Medium
- cinnamon kotaemonAn issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs...6.5 Medium
- py-pdf pypdfpypdf manipulated LZWDecode streams can exhaust RAM6.6 Medium
- processwireProcessWire CMS vulnerable to resource-exhaustion Denial of Service6.5 Medium
- ctfer-io chall-managerChall-Manager's scenario decoding process does not check for zip bombs8.7 High
- opensecurity mobile security framework, mobsf mobile-security-framework-mobsf +1 moreMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack6.8 Medium
- ibm concert, concert software +1 moreIBM Concert Software denial of service6.5 Medium
- framasoft peertubePeerTube User Import Authenticated Resource Exhaustion6.5 Medium
- ibm powervm hypervisorIBM PowerVM Hypervisor data manipulation4.5 Medium
- binary-husky binary-husky/gpt academic, gpt academic +1 moreImproper Input Validation in binary-husky/gpt_academic6.5 Medium
- ollama ollama/ollamaOut-Of-Memory (OOM) Vulnerability in ollama/ollama7.5 High
- h2o, h2oai h2oai/h2o-3 +1 moreDenial of Service in h2oai/h2o-37.5 High
- apache seata, apache software foundation seata (incubating) +1 morecompression bomb attack in Apache Seata Server4.3 Medium
- getkin kin-openapiImproper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter7.5 High
- ruby net-imapNet::IMAP vulnerable to possible DoS by memory exhaustion6.5 Medium
- mattermost, mattermost server +1 moreZipbomb DoS via Missing Slack Import Validation6.5 Medium
- microsoft .net, .net 9.0, visual studio 2022 version 17.10 +5 more +7 more.NET and Visual Studio Denial of Service Vulnerability7.5 High
- gitlabImproper Handling of Highly Compressed Data (Data Amplification) in GitLab4.3 Medium
- fedoraproject fedora, go-jose +1 moreGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)4.3 Medium
- apollographql apollo router, router +1 moreApollo Router's Compressed Payloads do not respect HTTP Payload Limits7.5 High
- scrapy, scrapy scrapy/scrapy +1 moreXML External Entity (XXE) Vulnerability in scrapy/scrapy7.5 High
- nettyNetty's BrotliDecoder is vulnerable to DoS via zip bomb style attack6.9 Medium
- gosaml2 project gosaml2gosaml2 vulnerable to Denial of Service via deflate decompression bomb5.3 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Client Vulnerable to Decompression Bombs in Artifact Block6.5 Medium
- hashicorp go-getterGo-Getter Vulnerable to Decompression Bombs4.2 Medium
- Show moreLoading…