# CWE-409.

Every Advisory and CVE whose sources give the weakness CWE-409, newest first.

## Records, newest first (an older page)

- [CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources](https://agentprime.io/advisories/GHSA-9mqm-qcwf-5qhg.md)
  `GHSA-9mqm-qcwf-5qhg` · PyPI `credsweeper`: affected `>=1.4.9, <1.16.0`, fixed in `1.16.0` · CVSS 5.5 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Denial of service, CWE-409
- [rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol](https://agentprime.io/advisories/CVE-2026-59803.md)
  `CVE-2026-59803` · CVE record: smallnest rpcx · CVSS 8.7 High · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-409
- [Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service](https://agentprime.io/advisories/GHSA-2mg2-p7r7-g27f.md)
  `GHSA-2mg2-p7r7-g27f`, `CVE-2026-55078`, `GO-2026-5916` · Go `github.com/coder/coder/v2`: affected `>=2.17.0, <2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service, CWE-409
- [NVIDIA Triton Inference Server: NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can…](https://agentprime.io/advisories/CVE-2026-24264.md)
  `CVE-2026-24264` · CVE record: NVIDIA Triton Inference Server · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-409
- [GPAC ISOBMFF base_encoding.c data amplification](https://agentprime.io/advisories/CVE-2026-13523.md)
  `CVE-2026-13523` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service, CWE-409
- [Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion](https://agentprime.io/advisories/CVE-2026-48044.md)
  `CVE-2026-48044` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-409
- [fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in \`in_opentelemetry\`](https://agentprime.io/advisories/GHSA-2jc5-xhx8-qj6h.md)
  `GHSA-2jc5-xhx8-qj6h`, `CVE-2026-44163` · RubyGems `fluent-plugin-opentelemetry`: affected `<0.5.3`, fixed in `0.5.3` · CVSS 5.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service, CWE-409
- [fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in \`in_s3\`](https://agentprime.io/advisories/GHSA-xv9w-7v6q-hpjh.md)
  `GHSA-xv9w-7v6q-hpjh`, `CVE-2026-44162` · RubyGems `fluent-plugin-s3`: affected `>=0.7.0, <1.8.5`, fixed in `1.8.5` · CVSS 2.7 Low · Not analysed yet · Published 26 Jun 2026 · Tags: Denial of service, CWE-409
- [Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in \`in_http\` and \`in_forward\`](https://agentprime.io/advisories/GHSA-j9cw-hwqf-85w7.md)
  `GHSA-j9cw-hwqf-85w7`, `BIT-fluentd-2026-44160`, `CVE-2026-44160` · RubyGems `fluentd`: affected `<1.19.3`, fixed in `1.19.3` · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-409
- [MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths](https://agentprime.io/advisories/GHSA-v72x-2h86-7f8m.md)
  `GHSA-v72x-2h86-7f8m`, `CVE-2026-48510` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Denial of service, CWE-409
- [MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows](https://agentprime.io/advisories/GHSA-382j-8mxh-c7x2.md)
  `GHSA-382j-8mxh-c7x2`, `CVE-2026-48502` · NuGet `MessagePack`: affected `>=3.0, <3.1.7`, fixed in `3.1.7` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption, Denial of service, Code injection, Insecure deserialization
- [py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size](https://agentprime.io/advisories/GHSA-gjrg-mpp7-g774.md)
  `GHSA-gjrg-mpp7-g774`, `CVE-2026-55195`, `PYSEC-2026-2972` · PyPI `py7zr`: affected `<1.1.3`, fixed in `1.1.3` · CVSS 8.7 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-409
- [Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification](https://agentprime.io/advisories/CVE-2026-47774.md)
  `CVE-2026-47774` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: Denial of service, CWE-405, CWE-409
- [vLLM: OOM Denial of Service via Audio Decompression Bomb](https://agentprime.io/advisories/GHSA-6pr9-rp53-2pmc.md)
  `GHSA-6pr9-rp53-2pmc`, `CVE-2026-54233`, `PYSEC-2026-3404` · PyPI `vllm`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-409
- [n8n: Denial of Service via ZIP decompression in webhook workflow](https://agentprime.io/advisories/GHSA-jqpw-qww5-cj4c.md)
  `GHSA-jqpw-qww5-cj4c`, `CVE-2026-54314` · npm `n8n`: affected `<2.24.0`, fixed in `2.24.0` · CVSS 6.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-409
- [tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)](https://agentprime.io/advisories/GHSA-mgf9-4vpg-hj56.md)
  `GHSA-mgf9-4vpg-hj56`, `CVE-2026-49855`, `PYSEC-2026-3389` · PyPI `tornado`: affected `<6.5.6`, fixed in `6.5.6` · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-409
- [aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup](https://agentprime.io/advisories/GHSA-g3cq-j2xw-wf74.md)
  `GHSA-g3cq-j2xw-wf74`, `CVE-2026-54278`, `PYSEC-2026-2111` · PyPI `aiohttp`: affected `<3.14.1`, fixed in `3.14.1` · CVSS 6.6 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-409
- [Apache HTTP Server: mod_http2 denial of service](https://agentprime.io/advisories/CVE-2026-49975.md)
  `CVE-2026-49975` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service, CWE-409
- [Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies](https://agentprime.io/advisories/GHSA-655f-mp8p-96gv.md)
  `GHSA-655f-mp8p-96gv`, `CVE-2026-49755`, `EEF-CVE-2026-49755` · Hex `req`: affected `>=0.1.0, <0.6.1`, fixed in `0.6.1` · CVSS 8.2 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-409
- [Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb](https://agentprime.io/advisories/CVE-2026-10725.md)
  `CVE-2026-10725` · CVE record: CRUX Protocol::HTTP2 · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2026 · Tags: CWE-409
- [Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend](https://agentprime.io/advisories/GHSA-r3xg-rg9j-67fv.md)
  `GHSA-r3xg-rg9j-67fv`, `CVE-2026-44018`, `PYSEC-2026-2144` · PyPI `docling`: affected `>=2.45.0, <2.91.0`, fixed in `2.91.0` · CVSS 5.5 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: XML external entities (XXE), Denial of service, CWE-409
- [Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression](https://agentprime.io/advisories/GHSA-mc85-72gr-vm9f.md)
  `GHSA-mc85-72gr-vm9f`, `CVE-2026-48594`, `EEF-CVE-2026-48594` · Hex `tesla`: affected `>=0.6.0, <1.18.3`, fixed in `1.18.3` · CVSS 8.2 High · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-409
- [ExifReader is vulnerable to denial of service via unbounded decompression of image metadata](https://agentprime.io/advisories/GHSA-rr89-w3h9-m66j.md)
  `GHSA-rr89-w3h9-m66j`, `CVE-2026-8814` · npm `exifreader`: affected `>=4.20.0, <4.39.0`, fixed in `4.39.0` · CVSS 6.9 Medium · Not analysed yet · Published 29 May 2026 · Tags: CWE-409
- [CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression](https://agentprime.io/advisories/GHSA-273h-gvwr-c3qj.md)
  `GHSA-273h-gvwr-c3qj`, `CVE-2026-44981`, `GO-2026-5041` · Go `github.com/crowdsecurity/crowdsec`: affected `>=1.7.0, <1.7.8`, fixed in `1.7.8` · CVSS 8.2 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-409
- [Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame](https://agentprime.io/advisories/GHSA-84f2-rp86-235p.md)
  `GHSA-84f2-rp86-235p`, `CVE-2026-43970`, `EEF-CVE-2026-43970` · Hex `cowlib`: affected `>=0.1.0, <2.16.1`, fixed in `2.16.1` · CVSS 8.2 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-409
- [Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload](https://agentprime.io/advisories/GHSA-87m7-qffr-542v.md)
  `GHSA-87m7-qffr-542v`, `CVE-2026-44697`, `GO-2026-5246` · Go `github.com/klever-io/klever-go`: affected `<=1.7.16`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 13 May 2026 · Tags: Denial of service, CWE-409
- [Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload](https://agentprime.io/advisories/CVE-2026-42886.md)
  `CVE-2026-42886` · CVE record: advplyr audiobookshelf · CVSS 4.9 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-409
- [urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API](https://agentprime.io/advisories/GHSA-mf9v-mfxr-j63j.md)
  `GHSA-mf9v-mfxr-j63j`, `CVE-2026-44432`, `PYSEC-2026-142` · PyPI `urllib3`: affected `>=2.6.0, <2.7.0`, fixed in `2.7.0` · CVSS 8.9 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-409
- [FITS GZIP decompression bomb in Pillow](https://agentprime.io/advisories/GHSA-whj4-6x5x-4v2j.md)
  `GHSA-whj4-6x5x-4v2j`, `BIT-pillow-2026-40192`, `CVE-2026-40192`, `PYSEC-2026-2250` · PyPI `pillow`: affected `>=10.3.0, <12.2.0`, fixed in `12.2.0` · CVSS 8.7 High · Not analysed yet · Published 13 Apr 2026 · Tags: Denial of service, CWE-409
- [PraisonAI Vulnerable to Decompression Bomb DoS via Recipe Bundle Extraction Without Size Limits](https://agentprime.io/advisories/GHSA-f2h6-7xfr-xm8w.md)
  `GHSA-f2h6-7xfr-xm8w`, `CVE-2026-40148`, `PYSEC-2026-2912` · PyPI `praisonai`: affected `<4.5.128`, fixed in `4.5.128` · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-409
- [Tandoor Recipes Affected by Denial of Service via Recipe Import](https://agentprime.io/advisories/CVE-2026-27460.md)
  `CVE-2026-27460` · CVE record: TandoorRecipes recipes · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-409
- [Duplicate Advisory: Unfurl's unbounded zlib decompression allows decompression bomb DoS](https://agentprime.io/advisories/GHSA-c3f2-qg8v-25q2.md)
  `GHSA-c3f2-qg8v-25q2` · PyPI `dfir-unfurl`: affected `<2026.04`, fixed in `2026.04` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-409
- [JWCrypto: JWE ZIP decompression bomb](https://agentprime.io/advisories/GHSA-fjrm-76x2-c4q4.md)
  `GHSA-fjrm-76x2-c4q4`, `CVE-2026-39373`, `PYSEC-2026-70` · PyPI `jwcrypto`: affected `<1.5.7`, fixed in `1.5.7` · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-409
- [Mattermost doesn't validate decompressed archive entry sizes during file extraction](https://agentprime.io/advisories/GHSA-vhgh-g7x8-4rx8.md)
  `GHSA-vhgh-g7x8-4rx8`, `CVE-2026-3114`, `GO-2026-5663` · Go `github.com/mattermost/mattermost/server/v8`: affected `>=8.0.0-20260105080200-d27a2195068d, <8.0.0-20260217110922-b7d4a1f1f59b || >=10.11.0, <10.11.12 || >=11.2.0, <11.2.4 || >=11.3.0, <11.3.2 || >=11.4.0, <11.4.1`, fixed in `8.0.0-20260217110922-b7d4a1f1f59b`, `10.11.12`, `11.2.4`, `11.3.2`, `11.4.1` · CVSS 6.5 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-409
- [NATS Server panic via malicious compression on leafnode port](https://agentprime.io/advisories/GHSA-52jh-2xxh-pwh6.md)
  `GHSA-52jh-2xxh-pwh6`, `BIT-nats-2026-29785`, `CVE-2026-29785`, `GO-2026-4829` · Go `github.com/nats-io/nats-server` and 1 more: affected `*`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-409
- [PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS](https://agentprime.io/advisories/GHSA-vrqm-gvq7-rrwh.md)
  `GHSA-vrqm-gvq7-rrwh`, `CVE-2026-82864` · npm `@pdfme/pdf-lib`: affected `<5.5.10`, fixed in `5.5.10` · CVSS 7.1 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-409
- [Keycloak: Denial of Service due to excessive SAMLRequest decompression](https://agentprime.io/advisories/GHSA-xv6h-r36f-3gp5.md)
  `GHSA-xv6h-r36f-3gp5`, `BIT-keycloak-2026-2575`, `CVE-2026-2575` · Maven `org.keycloak:keycloak-saml-adapter-core` and 2 more: affected `<26.5.4`, fixed in `26.5.4` · CVSS 5.3 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-409
- [file-type: ZIP Decompression Bomb DoS via \[Content_Types\].xml entry](https://agentprime.io/advisories/GHSA-j47w-4g3g-c36v.md)
  `GHSA-j47w-4g3g-c36v`, `CVE-2026-32630` · npm `file-type`: affected `>=20.0.0, <21.3.2`, fixed in `21.3.2` · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Denial of service, CWE-409
- [Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression](https://agentprime.io/advisories/GHSA-vrm6-8vpv-qv8q.md)
  `GHSA-vrm6-8vpv-qv8q`, `CVE-2026-1526` · npm `undici`: affected `<6.24.0 || >=7.0.0, <7.24.0`, fixed in `6.24.0`, `7.24.0` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: Denial of service, CWE-409
- [Pre-auth SSH DoS via unbounded zlib inflate](https://agentprime.io/advisories/CVE-2026-23943.md)
  `CVE-2026-23943` · CVE record: Erlang OTP · CVSS 6.9 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-409
- [MarkUs: Zip bomb in config upload enables DoS](https://agentprime.io/advisories/CVE-2026-25962.md)
  `CVE-2026-25962` · CVE record: MarkUsProject Markus · CVSS 6.5 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: CWE-409
- [Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib](https://agentprime.io/advisories/CVE-2026-28435.md)
  `CVE-2026-28435` · CVE record: yhirose cpp-httplib · CVSS 7.5 High · Not analysed yet · Published 4 Mar 2026 · Tags: Denial of service, CWE-409
- [OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)](https://agentprime.io/advisories/GHSA-77hf-7fqf-f227.md)
  `GHSA-77hf-7fqf-f227`, `CVE-2026-32044` · npm `openclaw`: affected `<2026.3.2`, fixed in `2026.3.2` · CVSS 6.7 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Denial of service, CWE-409
- [psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps](https://agentprime.io/advisories/GHSA-24p2-j2jr-386w.md)
  `GHSA-24p2-j2jr-386w`, `CVE-2026-27809`, `PYSEC-2026-2262` · PyPI `psd-tools`: affected `<1.12.2`, fixed in `1.12.2` · CVSS 6.8 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Memory corruption, Denial of service, CWE-409, CWE-704
- [Sliver has Potential Zip Bomb Denial of Service in GzipEncoder](https://agentprime.io/advisories/GHSA-2phg-qgmm-r638.md)
  `GHSA-2phg-qgmm-r638`, `GO-2026-4548` · Go `github.com/bishopfox/sliver`: affected `<1.7.2`, fixed in `1.7.2` · CVSS 4.0, no score published · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-409
- [nats-server websockets are vulnerable to pre-auth memory DoS](https://agentprime.io/advisories/GHSA-qrvq-68c2-7grw.md)
  `GHSA-qrvq-68c2-7grw`, `BIT-nats-2026-27571`, `CVE-2026-27571`, `GO-2026-4533` · Go `github.com/nats-io/nats-server` and 1 more: affected `<=1.4.1`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Denial of service, CWE-409
- [Unfurl's unbounded zlib decompression allows decompression bomb DoS](https://agentprime.io/advisories/GHSA-h5qv-qjv4-pc5m.md)
  `GHSA-h5qv-qjv4-pc5m`, `CVE-2026-40036`, `PYSEC-2026-1294` · PyPI `dfir-unfurl`: affected `<20260405`, fixed in `20260405` · CVSS 8.7 High · Not analysed yet · Published 29 Jan 2026 · Tags: Denial of service, CWE-409
- [Next.js has Unbounded Memory Consumption via PPR Resume Endpoint](https://agentprime.io/advisories/GHSA-5f7q-jpqc-wp7h.md)
  `GHSA-5f7q-jpqc-wp7h`, `CVE-2025-59472` · npm `next`: affected `>=15.0.0-canary.0, <=15.0.0-canary.205 || >=15.0.1-canary.0, <=15.0.1-canary.3 || >=15.0.2-canary.0, <=15.0.2-canary.11 || >=15.0.3-canary.0, <=15.0.3-canary.9 || >=15.0.4-canary.0, <=15.0.4-canary.52 || >=15.1.1-canary.0, <=15.1.1-canary.27 || >=15.2.0-canary.0, <=15.2.0-canary.77 || >=15.2.1-canary.0, <=15.2.1-canary.6 || >=15.2.2-canary.0, <=15.2.2-canary.7 || >=15.3.0-canary.0, <=15.3.0-canary.46 || >=15.3.1-canary.0, <=15.3.1-canary.15 || >=15.4.0-canary.0, <=15.4.0-canary.130 || >=15.4.2-canary.0, <=15.4.2-canary.56 || >=15.5.1-canary.0, <=15.5.1-canary.39 || >=15.6.0-canary.0, <15.6.0-canary.61 || >=16.0.0-beta.0, <16.1.5`, fixed in `15.6.0-canary.61`, `16.1.5` · CVSS 5.9 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Denial of service, CWE-409
- [GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS](https://agentprime.io/advisories/GHSA-ffj4-jq7m-9g6v.md)
  `GHSA-ffj4-jq7m-9g6v`, `CVE-2026-22870`, `PYSEC-2026-1429` · PyPI `guarddog`: affected `<2.7.1`, fixed in `2.7.1` · CVSS 7.1 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-409
- [cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb](https://agentprime.io/advisories/CVE-2026-22776.md)
  `CVE-2026-22776` · CVE record: yhirose cpp-httplib · CVSS 8.7 High · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-409
- [Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)](https://agentprime.io/advisories/GHSA-38jv-5279-wg99.md)
  `GHSA-38jv-5279-wg99`, `CVE-2026-21441`, `PYSEC-2026-1996` · PyPI `urllib3`: affected `>=1.22, <2.6.3`, fixed in `2.6.3` · CVSS 8.9 High · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-409
- [AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb](https://agentprime.io/advisories/GHSA-6mq8-rvhq-8wgg.md)
  `GHSA-6mq8-rvhq-8wgg`, `CVE-2025-69223`, `PYSEC-2026-1101` · PyPI `aiohttp`: affected `<3.13.3`, fixed in `3.13.3` · CVSS 7.5 High · Not analysed yet · Published 5 Jan 2026 · Tags: Denial of service, CWE-409
- [Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability.](https://agentprime.io/advisories/CVE-2025-66909.md)
  `CVE-2025-66909` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-409
- [Duplicate Advisory: python-jose denial of service via compressed JWE content](https://agentprime.io/advisories/GHSA-h4pw-wxh7-4vjj.md)
  `GHSA-h4pw-wxh7-4vjj`, `CVE-2024-29370`, `PYSEC-2025-185` · PyPI `python-jose`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-409
- [urllib3 streaming API improperly handles highly compressed data](https://agentprime.io/advisories/GHSA-2xpw-w6gg-jr37.md)
  `GHSA-2xpw-w6gg-jr37`, `CVE-2025-66471`, `PYSEC-2026-1994` · PyPI `urllib3`: affected `>=1.0, <2.6.0`, fixed in `2.6.0` · CVSS 8.9 High · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-409
- [pypdf's LZWDecode streams be manipulated to exhaust RAM](https://agentprime.io/advisories/GHSA-m449-cwjh-6pw7.md)
  `GHSA-m449-cwjh-6pw7`, `CVE-2025-66019`, `PYSEC-2026-1832` · PyPI `pypdf`: affected `<6.4.0`, fixed in `6.4.0` · CVSS 6.6 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Denial of service, CWE-409
- [An issue was discovered in Cinnamon kotaemon 0.11.0.](https://agentprime.io/advisories/CVE-2025-63914.md)
  `CVE-2025-63914` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: CWE-409
- [pypdf can exhaust RAM via manipulated LZWDecode streams](https://agentprime.io/advisories/GHSA-jfx9-29x2-rv3j.md)
  `GHSA-jfx9-29x2-rv3j`, `CVE-2025-62708`, `PYSEC-2026-1831` · PyPI `pypdf`: affected `<6.1.3`, fixed in `6.1.3` · CVSS 6.6 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-409
- [ProcessWire CMS vulnerable to resource-exhaustion Denial of Service](https://agentprime.io/advisories/GHSA-9p44-q66p-xm6p.md)
  `GHSA-9p44-q66p-xm6p`, `CVE-2025-60790`, `PKSA-rq7g-qqyk-nz8t` · Packagist `processwire/processwire`: affected `<=3.0.246`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Denial of service, CWE-409
- [Netty's decoders vulnerable to DoS via zip bomb style attack](https://agentprime.io/advisories/GHSA-3p8m-j85q-pgmj.md)
  `GHSA-3p8m-j85q-pgmj`, `CVE-2025-58057` · Maven `io.netty:netty-codec` and 1 more: affected `<4.1.125.Final`, fixed in `4.1.125.Final` · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-409

Newest: <https://agentprime.io/advisories/tag/cwe-409.md>
Older: <https://agentprime.io/advisories/tag/cwe-409.md?cursor=WyIyMDI1LTA5LTAzVDE4OjAwOjU1LjAwMDAwMFoiLCJHSFNBLTNwOG0tajg1cS1wZ21qIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-409&cursor=WyIyMDI2LTA3LTEzVDIyOjEyOjM3LjgzNzAwMFoiLCJDVkUtMjAyNi01ODQ4NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-409/?cursor=WyIyMDI2LTA3LTEzVDIyOjEyOjM3LjgzNzAwMFoiLCJDVkUtMjAyNi01ODQ4NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.