CVE-2026-112892 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 4.1.0 up to but not including 13.0.0. The issue involves the MSP RLE decoder, which can expand a small crafted MSP image into an unbounded in-memory buffer, leading to memory exhaustion and denial of service. This occurs because the decoder writes run-length output to BytesIO without limiting expansion to the declared image size, bypassing decompression-bomb checks. The vulnerability is fixed in version 13.0.0.
CVE-2026-102072 is a medium severity vulnerability in Juniper Networks Junos OS involving improper handling of highly compressed data in the gRPC library used by na-grpcd. An authenticated network-based attacker can exploit this flaw by sending a specially crafted compressed gRPC request to cause a denial of service (DoS). This vulnerability does not impact confidentiality or integrity but affects availability. Multiple versions of Junos OS prior to specific patch releases are affected. No known exploits are reported in the wild. No explicit patch links are provided in the input data.
OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 contain a vulnerability in CombinedResourceHandler where it accepts a structurally valid deflated and base64 encoded combined resource ID without verifying its authenticity. This allows attackers to forge IDs that can cause unbounded decoded output, memory exhaustion, and limited disclosure of Facelets source files. Additionally, in certain configurations, a forged ID can trigger a blind server-side fetch influenced by the request Host header. The issue is fixed in the stated versions.
CVE-2026-95502 is a vulnerability in Grafana Nanogit where a Git server used by Grafana's Git Sync provisioning can cause uncontrolled resource consumption by returning oversized or highly compressed responses. This can exhaust Grafana's memory. Exploitation requires that an administrator has configured Git Sync to use the vulnerable Git server. The vulnerability affects multiple version ranges of Grafana Nanogit and has a medium severity rating with a CVSS score of 5.3.
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
CVE-2026-105274 is a low severity vulnerability in Erlang's rebar3, hex, and hex_core components involving improper handling of highly compressed data. An untrusted repository mirror or server can send a small compressed response that decompresses into a very large data structure, exhausting the Erlang VM memory before signature verification. This occurs because decompression and decoding steps do not limit the size of the decompressed or decoded data. The vulnerability affects rebar3 versions from 3.9.1 up to but not including 3.27.3, hex from 2.1.0 up to but not including 2.5.2, and hex_core from 0.1.0 up to but not including 0.20.0.
CVE-2026-96618 is a low severity vulnerability in hexpm hex affecting versions from 0.11.2 up to but not including 2.5.2. It involves improper handling of highly compressed data that can lead to excessive memory or disk space consumption when using commands like mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. The vulnerability arises because hex processes untrusted mirrors without limiting the size of compressed or decompressed data, allowing a malicious mirror to cause resource exhaustion. This affects registry, package, docs, and API responses, with some paths lacking size limits or checksum verification. No known exploits are reported, and no official patch information is provided in the input data.
CVE-2026-107335 is a vulnerability in CISA Malcolm affecting versions from 0 up to and including 26.07.1. The issue involves improper handling of highly compressed single-stream files (e.g., .gz, .bz2) that are not tar-style archives. Authenticated users with upload permissions can upload small, highly compressible files that decompress to very large sizes, causing resource exhaustion on the shared Docker volume and disrupting the platform. The vulnerability has a CVSS score of 6.5 and is classified as medium severity.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.
CVE-2026-106585 is a medium severity vulnerability in OpenSSH versions before 10.6. It involves improper handling of highly compressed data during decompression in sshd and ssh, where no check is performed to ensure the maximum packet length is not exceeded. This can lead to data amplification issues.
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0.
CVE-2026-66054 is a medium severity vulnerability in Apache Thrift C++ bindings that involves allocation of resources without limits or throttling. This flaw leads to improper handling of highly compressed data, resulting in potential data amplification issues. The vulnerability affects Apache Thrift versions prior to 0.25.0. The issue has been fixed in version 0.25.0, and users are advised to upgrade to this version to mitigate the risk.
CVE-2026-94636 is a high-severity vulnerability in Apache Thrift's Python bindings affecting versions before 0.25.0. It involves improper handling of highly compressed data leading to data amplification, incorrect function call arguments, and improper validation of input quantities. The issue is fixed in Apache Thrift version 0.25.0.
CVE-2026-94637 is a high-severity vulnerability in Apache Thrift's Go bindings involving improper handling of highly compressed data, leading to data amplification issues. This flaw affects all versions before 0.25.0. The issue is resolved in Apache Thrift version 0.25.0, and users are advised to upgrade to this fixed version to mitigate the vulnerability.
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send many nested compressed frames, causing recursive decoding that exhausts the worker thread stack and aborts the process. The same nested construction amplifies decompressed input, and process termination can halt log ingestion for every tenant on a shared pipeline. This issue is fixed in version 0.57.0.