Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.
CVE-2026-47321 is a high-severity vulnerability in Apache MINA's CompressionFilter class where inflated data size is not properly controlled. This can lead to excessive memory consumption due to data amplification from highly compressed inputs. The vulnerability affects Apache MINA versions >=2.0.0 <2.0.29, >=2.1.0 <2.1.13, and >=2.2.0 <2.2.8. The fix introduces parameters to limit maximum decompressed size and decompression ratio, preventing memory exhaustion. Users are advised to upgrade and configure CompressionFilter accordingly.
Autobahn Python before version 26.7.1 has a vulnerability in its WebSocket implementation where compressed messages can bypass the configured maximum message payload size after decompression. This allows a remote unauthenticated attacker to send a compressed frame within the allowed size that decompresses to a much larger message, causing resource exhaustion. The issue does not impact confidentiality or integrity. The vulnerability is fixed in version 26.7.1.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams do not reach, and overlapping icef units can decompress the same payload repeatedly. HeifContext::interpret_heif_file_images() processes multiple compressed metadata items during file opening, allowing a small file to consume unbounded memory and terminate the process. This issue is fixed in version 1.23.2.
CVE-2026-89059 is a high-severity vulnerability in Red Hat RESTEasy's IIOImageProvider component. It allows a remote, unauthenticated attacker to cause a denial of service by sending a crafted image with extremely large declared dimensions, triggering excessive memory allocation and exhausting the JVM heap. This flaw affects REST endpoints configured to process image MIME types using the Java Image I/O provider. The vulnerability is fixed in versions 6.2.19.Final and 7.0.5.Final.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who can alter a response in transit, can send a small gzip, deflate, or snappy response that expands across chunks until the client exhausts its heap and raises OutOfMemoryError; brotli and zstd are also affected when their optional codecs are present. In versions 3.0.8 through 3.0.10, the HTTP/2 decompressor is also unbounded, so switching protocols does not mitigate the issue on those releases. A limit applied to each decode call is insufficient because the response can be delivered as many small chunks, so the fixed implementation tracks total decompressed bytes for the whole response. This issue is fixed in versions 2.16.1 and 3.0.12.
Apache NiFi version 2.11.0 contains a vulnerability related to improper handling of gzip-encoded HTTP requests. The application REST API disabled support for gzip encoding but did not properly validate multiple Content-Encoding headers or non-standard gzip identifiers. This flaw allows crafted requests to consume excessive memory, leading to potential denial of service. Upgrading to version 2.12.0 mitigates this issue by disabling decompression of gzip-encoded HTTP requests regardless of header variations.
CVE-2026-81875 is a high-severity vulnerability in HAPI FHIR's org.hl7.fhir.core component prior to version 6.9.12. The SHCParser improperly validates input when decompressing Smart Health Card JWT content with a 'zip' header set to 'DEF'. This leads to unbounded memory allocation during decompression, potentially causing excessive heap usage, severe garbage collection pressure, request failures, or process crashes. The issue is fixed in version 6.9.12.
CVE-2026-44163 is a medium severity vulnerability in fluent-plugin-opentelemetry prior to version 0.5.3. The in_opentelemetry HTTP input component reads and decompresses incoming request bodies into memory without enforcing size limits, allowing attackers to send highly compressed payloads that expand significantly in memory. This can lead to memory exhaustion and cause the Fluentd process to be terminated by the operating system, disrupting log collection and forwarding on the affected node. The issue is fixed in version 0.5.3.
A vulnerability in fluent-plugin-s3 versions 0.7.0 through 1.8.4 allows an attacker with upload permissions to an S3 bucket to cause memory exhaustion by uploading a highly compressed object that decompresses to a large size. This can lead to the Fluentd process being terminated by the operating system, disrupting log collection. The issue is fixed in version 1.8.5.
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened.
On the first request to /vscode/unpkg/{namespace}/{extension}/{version}/{path}, WebResourceService opened the entry with ZipFile.getInputStream() and passed the decompressed stream to Files.copy(), which ran to the end of the stream without counting bytes written. The result was cached under java.io.tmpdir, and that cache evicted by entry count (150), not by size, so it placed no bound on disk usage.
A publisher with access only to their own namespace could therefore upload a small, highly compressible VSIX and cause the server to write far larger files to the temp filesystem — repeating with different files or versions, since a repeat request is served from the cache.
Impact observed: the temp filesystem filled; requests for files not already cached returned 500 with No space left on device; a failed extraction left a partial cache file that blocked later attempts at that path; publishing failed with Failed to read extension file. Metadata and already-cached files kept working, and the server did not stop.
Triggering the extraction needs no authentication — only the upload does.
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
CVE-2026-69304 is a vulnerability in Microsoft .NET runtime versions prior to certain fixed releases, involving improper handling of highly compressed data in ASP.NET Core. This flaw can be exploited by an unauthorized attacker to cause a denial of service (DoS) over a network. The issue is classified under CWE-409 (Improper Handling of Highly Compressed Data) and has a medium severity rating with a CVSS score of 5.9. Official patches have been released to address this vulnerability.
CVE-2026-85786 is a high-severity vulnerability in Amazon ion-java before version 1.12.1. It involves improper handling of highly compressed Ion documents that can cause denial of service by expanding to an arbitrarily large size upon decompression. This occurs due to insufficient coverage of a GZIP auto-decompression opt-out mechanism introduced in a previous fix. The issue is resolved by upgrading to ion-java version 1.12.1.
### Summary
When decoding a compressed response body (`gzip`, `deflate`, `br`, or `zstd`), HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the response to keep memory usage bounded.
### Details
HTTPX2's default transport reads the socket in pieces of up to 64 KiB. Before `2.12.0`, each piece was inflated completely into one intermediate allocation before any decompressed bytes were yielded.
At DEFLATE's maximum compression ratio of roughly 1032:1, a 64 KiB compressed chunk can expand to about 64 MiB in one allocation. Brotli and Zstandard responses can cause similarly large amplification. Streaming the response did not prevent these transient allocations.
### Impact
Applications that fetch resources from untrusted or attacker-influenced servers - such as webhook receivers, link unfurlers, crawlers, SSRF-reachable fetchers, and redirect followers - can experience memory pressure or out-of-memory termination when processing a malicious compressed response. No authentication or user interaction is required beyond issuing a request to the server.
### Mitigation
Upgrade to HTTPX2 `2.12.0` or later. Patched versions decompress responses incrementally with bounded intermediate buffers, including responses with multiple content encodings.
Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory available to APM Server when it is later processed, terminating the process. The condition recurs on every restart until the stored content is removed.
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.