CWE-409 · 145 records

Improper Handling of Highly Compressed Data (Data Amplification)

CVEs in this class

146 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-21441No exploit	urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)python · urllib3 · CWE-409 Pre-auth	High8.9	—	2.9%	Jan 7, 2026
35Monitor	CVE-2026-44432No exploit	urllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIpython · urllib3 · CWE-409 Pre-auth	High8.9	—	0.9%	May 13, 2026
35Monitor	CVE-2026-68981No exploit	Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requestsapache · nifi · CWE-409 Pre-auth	High8.8	—	0.7%	Aug 3, 2026
35Monitor	CVE-2025-66471No exploit	urllib3 Streaming API improperly handles highly compressed datapython · urllib3 · CWE-409 Pre-auth	High8.9	—	0.7%	Dec 5, 2025
34Monitor	CVE-2026-48586No exploit	Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limitapache · thrift · CWE-409 Pre-auth	High8.7	—	1.0%	Jul 27, 2026
34Monitor	CVE-2026-40036No exploit	Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompressionryandfir · unfurl · CWE-409 Pre-auth	High8.7	—	0.8%	Apr 8, 2026
34Monitor	CVE-2026-82520No exploit	parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachmentsdomainaware · parsedmarc · CWE-409 Pre-auth	High8.7	—	0.8%	Sep 3, 2026
34Monitor	CVE-2026-59803No exploit	rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocolsmallnest · rpcx · CWE-409 Pre-auth	High8.7	—	0.7%	Jul 8, 2026
34Monitor	CVE-2026-92000No exploit	adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Sizecthackers · adm-zip · CWE-409 Pre-auth	High8.7	—	0.7%	Sep 15, 2026
34Monitor	CVE-2026-78206No exploit	exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompressionexceljs · exceljs · CWE-409 Pre-auth	High8.7	—	0.6%	Aug 24, 2026
34Monitor	CVE-2026-75936No exploit	Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-javaamazon ion · amazon ion java · CWE-409 Pre-auth	High8.7	—	0.6%	Aug 18, 2026
34Monitor	CVE-2026-85786No exploit	Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaamazon · ion-java · CWE-409 Pre-auth	High8.7	—	0.6%	Sep 4, 2026
34Monitor	CVE-2026-103262No exploit	Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClienttornadoweb · tornado · CWE-409 Pre-auth	High8.7	—	0.5%	Oct 1, 2026
34Monitor	CVE-2026-62963No exploit	Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportcentrifugal · centrifugo · CWE-409 Pre-auth	High8.7	—	0.5%	Jul 16, 2026
34Monitor	CVE-2026-53430No exploit	grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1elixir-grpc · grpc · CWE-409 Pre-auth	High8.7	—	0.5%	Jun 15, 2026
34Monitor	CVE-2026-77620No exploit	Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).vectordotdev · vector · CWE-409 Pre-auth	High8.7	—	0.5%	Sep 22, 2026
34Monitor	CVE-2026-109226No exploit	SGLang through 0.5.21 Audio Decompression Amplification via load_audiosgl-project · sglang · CWE-409 Pre-auth	High8.7	—	0.5%	3 days ago
34Monitor	CVE-2026-44697No exploit	Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadklever-io · klever-go · CWE-409 Pre-auth Denial of service	High8.6	—	0.5%	May 29, 2026
34Monitor	CVE-2026-109398No exploit	Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombsgumlet · php-image-resize · CWE-409 Pre-auth	High8.7	—	0.5%	3 days ago
34Monitor	CVE-2026-109229No exploit	SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessorsgl-project · sglang · CWE-409 Pre-auth	High8.7	—	0.4%	3 days ago
34Monitor	CVE-2026-22776No exploit	cpp-httplib vulnerable to a denial of service (DOS) using a zip bombyhirose · cpp-httplib · CWE-409 Pre-auth	High8.7	—	0.4%	Jan 12, 2026
34Monitor	CVE-2026-97334No exploit	Network messaging layer decompression resource exhaustioncommvault · commvault cloud · CWE-409 Pre-auth	High8.7	—	0.4%	2 days ago
34Monitor	CVE-2026-55195No exploit	py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction sizemiurahr · py7zr · CWE-409 Pre-auth	High8.7	—	0.3%	Jul 8, 2026
34Monitor	CVE-2026-68911No exploit	Nicotine+: Decompression of peer messages can exhaust available memorynicotine-plus · nicotine-plus · CWE-409 Pre-auth	High8.7	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-102477No exploit	In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable peeclipse foundation · eclipse vert.x · CWE-409 Pre-auth	High8.7	—	—	Today

CVE-2026-21441
36Monitor
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
HighCVSS 8.9No exploitEPSS 3%
- Pre-auth
python · urllib3Jan 7, 2026
CVE-2026-44432
35Monitor
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
python · urllib3May 13, 2026
CVE-2026-68981
35Monitor
Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
apache · nifiAug 3, 2026
CVE-2025-66471
35Monitor
urllib3 Streaming API improperly handles highly compressed data
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
python · urllib3Dec 5, 2025
CVE-2026-48586
34Monitor
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
apache · thriftJul 27, 2026
CVE-2026-40036
34Monitor
Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
ryandfir · unfurlApr 8, 2026
CVE-2026-82520
34Monitor
parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
domainaware · parsedmarcSep 3, 2026
CVE-2026-59803
34Monitor
rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
smallnest · rpcxJul 8, 2026
CVE-2026-92000
34Monitor
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
cthackers · adm-zipSep 15, 2026
CVE-2026-78206
34Monitor
exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
exceljs · exceljsAug 24, 2026
CVE-2026-75936
34Monitor
Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
amazon ion · amazon ion javaAug 18, 2026
CVE-2026-85786
34Monitor
Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
amazon · ion-javaSep 4, 2026
CVE-2026-103262
34Monitor
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
tornadoweb · tornadoOct 1, 2026
CVE-2026-62963
34Monitor
Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
centrifugal · centrifugoJul 16, 2026
CVE-2026-53430
34Monitor
grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
elixir-grpc · grpcJun 15, 2026
CVE-2026-77620
34Monitor
Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
vectordotdev · vectorSep 22, 2026
CVE-2026-109226
34Monitor
SGLang through 0.5.21 Audio Decompression Amplification via load_audio
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
sgl-project · sglang3 days ago
CVE-2026-44697
34Monitor
Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
klever-io · klever-goMay 29, 2026
CVE-2026-109398
34Monitor
Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
gumlet · php-image-resize3 days ago
CVE-2026-109229
34Monitor
SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
sgl-project · sglang3 days ago
CVE-2026-22776
34Monitor
cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
yhirose · cpp-httplibJan 12, 2026
CVE-2026-97334
34Monitor
Network messaging layer decompression resource exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
commvault · commvault cloud2 days ago
CVE-2026-55195
34Monitor
py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
miurahr · py7zrJul 8, 2026
CVE-2026-68911
34Monitor
Nicotine+: Decompression of peer messages can exhaust available memory
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
nicotine-plus · nicotine-plusSep 29, 2026
CVE-2026-102477
34Monitor
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable pe
HighCVSS 8.7No exploit
- Pre-auth
eclipse foundation · eclipse vert.xToday

All vulnerability classes