CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
A kind of CWE-405 Asymmetric Resource Consumption (Amplification).
From the CWE List. © The MITRE Corporation.
Newest
- tornadoweb tornadoTornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient8.7 High
- watchguard fireware, fireware os +1 moreFireware OS Resource Exhaustion in Login Process Allows Denial of Service8.7 High
- nicotine-plusNicotine+: Decompression of peer messages can exhaust available memory8.7 High
- apache qpid broker-jApache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering6.5 Medium
- docmostDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service6.5 Medium
- netdataNetdata: WebSocket Decompression Bomb7.5 High
- vectordotdev vectorVector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).8.7 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Web-MQTT decompression bomb8.2 High
- checkmk gmbh checkmkMissing decompression size limit in agent receiver allows memory exhaustion via push agent data5.3 Medium
- apache software foundation minaApache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate7.5 High
- oisf suricataSuricata http1: repeated brotli compression bombs can cause excessive CPU consumption7.5 High
- sveltejs devaluedevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5 High
- crossbario autobahn-pythonAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation5.3 Medium
- red hat build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3, build of apicurio registry 3 +19 more +21 moreResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)7.5 High
- asynchttpclient async-http-clientAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service7.5 High
- apache nifiApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests7.5 High
- hapifhir org.hl7.fhir.coreHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service7.5 High
- cthackers adm-zipadm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size8.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Denial of Service via Decompression Bomb7.1 High
- mattermost, mattermost server +1 moreUnbounded zlib decompression in Calls SDP WebSocket messages6.5 Medium
- mattermost, mattermost server +1 moreUploading a crafted image causes excessive memory allocation in the Mattermost Server6.5 Medium
- eclipse foundation openvsxPublishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by...4.3 Medium
- vllmvLLM before 0.28.0 Denial of Service via Audio Header7.1 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.3 High
- microsoft .net, asp.net core, .net 10.0 runtime +10 more +12 moreASP.NET Core Denial of Service Vulnerability5.9 Medium
- strukturag libheiflibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS7.5 High
- amazon ion-javaIncomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java8.7 High
- domainaware parsedmarcparsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments8.7 High
- pydantic httpx2HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)7.5 High
- elastic apm serverImproper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service4.9 Medium
- elastic kibanaImproper Handling of Highly Compressed Data in Kibana Leading to Denial of Service6.5 Medium
mysql2npm,@rootio/mysql2Root +1 moreMySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials8.2 High- ericsson codecheckerAuthenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun5.5 Medium
- spring integration, vmware spring integration +1 moreUnbounded decompression in UnZipTransformer enables zip-bomb DoS6.5 Medium
- http4s, org.http4s http4s-ember-core 2.12, http4s-ember-core 2.13 +1 more +3 moreHttp4s: HTTP/2 Denial of Service with Ember Backend8.2 High
- perber leafwikiLeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction7.1 High
- exceljsexceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression8.7 High
- tanium findingsTanium addressed a compression bomb vulnerability in Findings.3.1 Low
- tanium threat responseTanium addressed a compression bomb vulnerability in Threat Response.3.1 Low
- amazon ion javaMemory-amplification denial of service via GZIP decompression bomb in Amazon ion-java8.7 High
- cisagov malcolmImproper handling of highly compressed data (data amplification) in CISA Malcolm7.1 High
- cisagov malcolmIncorrect Authorization in CISA Malcolm5.3 Medium
- wazuh, wazuh wazuh-manager +1 moreWazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb6.9 Medium
- carboneResource Exhaustion in Carbone6.9 Medium
- http4khttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the...6.5 Medium
- mattermost, mattermost server +1 moreBoards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost6.5 Medium
- ffufffuf denial of service (OOM) via HTTP response decompression bomb7.5 High
- weechatWeeChat has a Decompression Bomb in Relay WebSocket (DoS)6.5 Medium
- apache nifiApache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests8.8 High
- Show moreLoading…