CVE-2026-84161 is a vulnerability in Ericsson CodeChecker versions prior to 6.29.3 where enabling the store.analysis_statistics_dir feature allows authorized users with PRODUCT_STORE permission to submit highly compressed Base64-encoded data that is decompressed without size limits. This can lead to excessive memory and disk usage, potentially exhausting resources and impairing service availability. The feature is disabled by default, and no authorization bypass or path traversal is involved.
CVE-2026-121820 is a high-severity vulnerability in LY Corporation's Armeria library (armeria-saml) prior to version 1.43.0. The flaw involves improper handling of highly compressed SAML messages in the HTTP-Redirect binding decoder, which decompresses attacker-supplied data without limiting the output size before signature validation. This can allow an unauthenticated remote attacker to exhaust server memory, resulting in a denial of service.
CVE-2026-119434 is a vulnerability in silviucpp ezstd versions from 1.0.5 up to but not including 1.2.5. It involves improper handling of highly compressed data frames in the decompression function using dictionaries, which can lead to excessive memory allocation and cause the Erlang VM to terminate unexpectedly.
Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses.
Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory.
A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.
CVE-2026-117677 is a vulnerability in Gitea versions prior to 28.3.0 where the application improperly handles decompression of uploaded Helm chart archives. The decompression process reads every tar entry searching for Chart.yaml without limiting the decompressed size, and this occurs before enforcing the package size quota, which only considers compressed size. This allows a user with package write access to upload small compressed archives that decompress to large sizes, causing excessive CPU usage and degrading service availability. The flaw does not permit code execution or unauthorized data access.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar archive can consume disproportionately large memory and exhaust API-server resources. Multipart pipeline and pipeline-version upload processing performs decompression before namespace authorization, so a reachable caller does not need a successful pipeline-create authorization decision. URL-import handlers authorize before fetching and decompressing a remote archive. The amount of expansion required to interrupt service depends on deployment resource limits and concurrent activity, and no specific archive is guaranteed to crash every deployment. This issue is fixed in version 2.18.0.
A vulnerability in the labstack Echo Go web framework versions 4.0.0 through 4.16.0 allows uncontrolled resource consumption via the opt-in Decompress middleware. This middleware exposes a gzip-decoded request stream without limiting its expanded size, enabling a small compressed request to expand into a very large body. This can lead to excessive memory or CPU usage and potential denial of service when the handler reads or binds the request. The issue is fixed in version 4.16.1.
CVE-2026-111073 is a vulnerability in Apache Kafka's broker-side PushTelemetry API where the system validates only the compressed payload size before decompression, allowing a small compressed payload to decompress into a very large heap allocation. This can lead to excessive memory consumption and potential broker crashes due to OutOfMemoryError. The vulnerability affects Apache Kafka versions from 3.7.0 through 4.1.2, 4.2.0 through 4.2.1, and version 4.3.0. Fixed versions include Apache Kafka 4.2.2, 4.3.1, and 4.4.0, which enforce a maximum decompressed size limit equal to telemetry.max.bytes. The vulnerability requires an authenticated client but is not restricted by ACLs.
A vulnerability in crossbario autobahn-python versions 26.7.1 through 26.10.0 allows an unauthenticated WebSocket client to cause a memory exhaustion denial of service. The issue arises because the Brotli decompressor is called without an output limit, allowing a small, highly compressed frame to expand to hundreds of MiB before the server enforces the maximum message payload size. This flaw affects servers that enable the permessage-brotli feature via the compress extra. The vulnerability is fixed in version 26.10.1.
CVE-2026-65627 is a vulnerability in the potatosalad jose library (erlang-jose) that allows remote attackers to cause a denial of service by exhausting node memory. The flaw arises from improper handling of highly compressed JWE tokens using the DEFLATE compression method, where decompression is performed without limits on output size or inflation ratio. An attacker can craft a small JWE token that inflates to very large memory usage, crashing the BEAM runtime. This affects versions from 1.0.0 up to but not including 1.11.13. A fix is available in version 1.11.13.
CVE-2026-93850 is a vulnerability in Mattermost versions 11.7.0 through 11.7.10, 11.8.0 through 11.8.5, 11.9.0 through 11.9.1, and 11.10.0 through 11.10.1. It involves improper handling of highly compressed PDF data, allowing an authenticated user to upload a crafted PDF whose compressed content expands into a very large amount of text. This can exhaust server memory and cause a denial of service (DoS).
CVE-2026-97200 is a high-severity vulnerability in benoitc hackney versions from 2.0.0-beta.1 up to but not including 4.9.0. It involves improper handling of highly compressed HTTP response bodies, allowing a malicious server to exhaust client memory by sending oversized or highly compressed responses. The vulnerability arises because hackney buffers the entire response body without limits and decompresses it in one step, leading to potential resource exhaustion.
CVE-2026-109584 is a high-severity vulnerability in the HTTP/2 implementation of the mtrudel bandit server. It involves improper handling of highly compressed HPACK header blocks, allowing an unauthenticated remote attacker to cause excessive memory allocation by exploiting data amplification. The vulnerability affects bandit versions from 0.3.3 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-115638 is a vulnerability in OpenStack Ironic up to version 39.0.1 that allows denial of service via a specially crafted configdrive containing highly compressed data (a gzip bomb). This causes excessive uncompressed data consumption, leading to resource exhaustion.
CVE-2026-113873 is a vulnerability in SmileCDR HAPI FHIR where the software improperly handles highly compressed data. This flaw allows unauthenticated attackers to send specially crafted compressed payloads that can exhaust the server's heap memory or crash certain services during decompression. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating significant impact on availability but no direct impact on confidentiality or integrity.
CVE-2026-93471 is a high-severity vulnerability in the esaml library used by handnot2. It involves improper handling of highly compressed SAMLResponse data, allowing an unauthenticated attacker to cause a denial of service by exhausting server memory and crashing the Erlang VM. The vulnerability arises because the esaml_binding:decode_response/2 function decompresses attacker-controlled input without limiting output size, leading to extreme memory amplification.
A vulnerability in the python-pillow Pillow library prior to version 13.0.0 allows crafted multi-frame MPO or DCX images to cause uncontrolled memory consumption. This occurs because later frames can declare sizes that exceed limits without triggering decompression bomb checks, leading to potential denial of service via memory exhaustion. The issue is resolved in version 13.0.0.
A resource consumption vulnerability exists in python-pillow Pillow versions prior to 13.0.0. The SpiderImageFile.seek() function can reparse a later SPIDER stack frame and replace the image size without rerunning the decompression bomb check, allowing an attacker to declare very large image dimensions. This can cause excessive memory allocation, potentially consuming multiple gigabytes of memory. The issue is fixed in version 13.0.0.
A vulnerability in Django REST framework versions from 3.6.4 up to but not including 3.18.2 allows remote unauthenticated clients to send highly compressed JSON request bodies that expand significantly in memory after initial size checks. This improper handling of compressed data can cause excessive memory consumption per worker, potentially leading to denial of service. The issue is fixed in version 3.18.2.