CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- mattermost, mattermost server +1 moreMattermost Server Denial of Service via Animated GIF Emoji Upload6.5 Medium
- apache thriftApache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb7.5 High
- apache thriftApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit8.7 High
- apache thriftApache Thrift: Unbounded Zlib Decompression in Python THeaderTransport7.5 High
- omnifacesOmniFaces: Forged combined-resource IDs and related output/push boundaries8.2 High
- cloudreveCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)6.5 Medium
- phpoffice phpspreadsheetPhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion7.5 High
- gitea open source git serverDenial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload6.2 Medium
- centrifugal centrifugoCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport8.7 High
adawolfa/isdocPackagistadawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files6.5 Medium- getgrav gravGrav before 2.0.2 Decompression Bomb via Forged ZIP Size7.1 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreSoupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service7.5 High
- trellix hx consoleAn attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data...6.0 Medium
- hedgedocHedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter8.3 High
credsweeperPyPICredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources5.5 Medium- getgrav gravGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()6.9 Medium
- getgrav gravGrav: Decompression Bomb via ZipArchiver - Missing Extraction Limits6.5 Medium
- getgrav gravGrav before 2.0.1 Decompression Bomb via ZipArchiver7.1 High
- smallnest rpcxrpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol8.7 High
- httplib2httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling7.5 High
- coderCoder: Zip upload decompression lacks aggregate size limit, enabling denial of service6.5 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause...7.5 High
gpacDebianGPAC ISOBMFF base_encoding.c data amplification4.8 Medium- envoyproxy envoyEnvoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion7.5 High
- fluent-plugins-nursery fluent-plugin-opentelemetryfluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`5.3 Medium
- fluent fluent-plugin-s3fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`2.7 Low
- fluent fluentdFluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`7.5 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows8.2 High
- messagepack, messagepack-csharp +1 moreMessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths6.3 Medium
- miurahr py7zrpy7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size8.7 High
- envoyproxy envoy, red hat openshift service mesh 2.6, openshift service mesh 3.0 +4 more +6 moreEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification7.5 High
- vllmvLLM: OOM Denial of Service via Audio Decompression Bomb6.5 Medium
- n8nn8n: Denial of Service via ZIP decompression in webhook workflow6.3 Medium
- elixir-grpc grpcgrpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/18.7 High
- aio-libs aiohttpAIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup6.6 Medium
- tornadoweb tornadotornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)7.5 High
github.com/apple/swift-nio-extrasSwiftURLNIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length6.9 Medium- wojtekmach reqDecompression bomb DoS in Req via auto-decoded archive and compressed response bodies8.2 High
- crux protocol::http2, protocol\ +1 moreProtocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb7.5 High
- doclingDocling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend5.5 Medium
- apache http server, debian linux, red hat jboss core services for rhel 8 +19 more +21 moreApache HTTP Server: mod_http2 denial of service7.5 High
- elixir-tesla teslaDecompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression8.2 High
- oisf suricataSuricata http2: decompression bomb can cause denial of service in Suricata7.5 High
- crowdsecurity crowdsecCrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression8.2 High
exifreadernpmExifReader is vulnerable to denial of service via unbounded decompression of image metadata6.9 Medium- ninenines cowlibDecompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame8.2 High
- klever-io klever-goKlever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload8.6 High
- advplyr audiobookshelfAudiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload4.9 Medium
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming API8.9 High
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bomb8.7 High
- Show moreLoading…