# CWE-409.

Every Advisory and CVE whose sources give the weakness CWE-409, newest first.

## Records, newest first (an older page)

- [Netdata: WebSocket Decompression Bomb](https://agentprime.io/advisories/CVE-2026-83599.md)
  `CVE-2026-83599` · CVE record: netdata netdata · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-409
- [Vector: Unauthenticated denial of service in the \`logstash\` source via nested compressed frames (stack exhaustion and decompression amplification).](https://agentprime.io/advisories/CVE-2026-77620.md)
  `CVE-2026-77620` · CVE record: vectordotdev vector · CVSS 8.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-409
- [Missing decompression size limit in agent receiver allows memory exhaustion via push agent data](https://agentprime.io/advisories/CVE-2026-77021.md)
  `CVE-2026-77021` · CVE record: Checkmk GmbH Checkmk · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-409
- [Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate](https://agentprime.io/advisories/CVE-2026-47321.md)
  `CVE-2026-47321` · CVE record: Apache Software Foundation Apache MINA · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Denial of service, CWE-409
- [Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption](https://agentprime.io/advisories/CVE-2026-63452.md)
  `CVE-2026-63452` · CVE record: OISF suricata · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service, CWE-409
- [libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS](https://agentprime.io/advisories/CVE-2026-84384.md)
  `CVE-2026-84384` · CVE record: strukturag libheif · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-409
- [Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)](https://agentprime.io/advisories/CVE-2026-89059.md)
  `CVE-2026-89059` · CVE record: Red Hat and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-409
- [HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service](https://agentprime.io/advisories/GHSA-3w98-rrpr-fprr.md)
  `GHSA-3w98-rrpr-fprr`, `CVE-2026-81875` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.r5` and 2 more: affected `<6.9.12`, fixed in `6.9.12` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service, CWE-20, CWE-409
- [AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service](https://agentprime.io/advisories/GHSA-7grg-jcf7-rpmx.md)
  `GHSA-7grg-jcf7-rpmx`, `CVE-2026-85721` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1`, fixed in `3.0.12`, `2.16.1` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service, CWE-409
- [Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer](https://agentprime.io/advisories/GHSA-8h9x-89f2-m7x3.md)
  `GHSA-8h9x-89f2-m7x3`, `CVE-2026-61449`, `PKSA-yvdd-fpv6-9ncp` · Packagist `getgrav/grav`: affected `>=2.0.1, <2.0.2`, fixed in `2.0.2` · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-409
- [Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()](https://agentprime.io/advisories/GHSA-2vcx-h8p2-9pg9.md)
  `GHSA-2vcx-h8p2-9pg9`, `CVE-2026-59193`, `PKSA-4j1y-b223-8d57` · Packagist `getgrav/grav`: affected `>=1.0.0, <2.0.0`, fixed in `2.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-409
- [Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests](https://agentprime.io/advisories/CVE-2026-70469.md)
  `CVE-2026-70469` · CVE record: Apache Software Foundation Apache NiFi · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-409
- [Unbounded zlib decompression in Calls SDP WebSocket messages](https://agentprime.io/advisories/CVE-2026-5132.md)
  `CVE-2026-5132` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-409
- [Uploading a crafted image causes excessive memory allocation in the Mattermost Server](https://agentprime.io/advisories/CVE-2026-15814.md)
  `CVE-2026-15814` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-409
- [Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened.](https://agentprime.io/advisories/CVE-2026-89321.md)
  `CVE-2026-89321` · CVE record: Eclipse Foundation Eclipse OpenVSX · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-409
- [vLLM before 0.28.0 Denial of Service via Audio Header](https://agentprime.io/advisories/CVE-2026-90555.md)
  `CVE-2026-90555` · CVE record: vllm-project vLLM · CVSS 7.1 High · Not analysed yet · Published 12 Sept 2026 · Tags: CWE-409
- [Suricata http2: decompression bomb can cause denial of service in Suricata](https://agentprime.io/advisories/CVE-2026-46387.md)
  `CVE-2026-46387` · CVE record: OISF suricata · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-409
- [Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-8cp2-47hg-mfgh.md)
  `GHSA-8cp2-47hg-mfgh`, `BIT-aspnet-core-2026-69304`, `BIT-dotnet-2026-69304`, `BIT-dotnet-sdk-2026-69304`, `CVE-2026-69304` · NuGet `Microsoft.AspNetCore.Server.IISIntegration`: affected `>=8.0.0, <8.0.31 || >=9.0.0, <9.0.20 || >=10.0.0, <10.0.12 || >=11.0.0-preview.1, <11.0.0-rc.1`, fixed in `8.0.31`, `9.0.20`, `10.0.12`, `11.0.0-rc.1` · CVSS 5.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-409
- [Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerabili…](https://agentprime.io/advisories/CVE-2026-79695.md)
  `CVE-2026-79695` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-409
- [HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)](https://agentprime.io/advisories/GHSA-8xx6-hgc6-gc2m.md)
  `GHSA-8xx6-hgc6-gc2m`, `CVE-2026-84382`, `PYSEC-2026-3846` · PyPI `httpx2`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-409
- [Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-v3f6-m9j2-437p.md)
  `GHSA-v3f6-m9j2-437p` · NuGet `Microsoft.AspNetCore.Server.IISIntegration`: affected `>=8.0.0, <8.0.31 || >=9.0.0, <9.0.20 || >=10.0.0, <10.0.12 || >=11.0.0-preview.1, <11.0.0-rc.1`, fixed in `8.0.31`, `9.0.20`, `10.0.12`, `11.0.0-rc.1` · CVSS 5.9 Medium · Withdrawn · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-409
- [Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java](https://agentprime.io/advisories/CVE-2026-85786.md)
  `CVE-2026-85786` · CVE record: Amazon ion-java · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-409
- [parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments](https://agentprime.io/advisories/CVE-2026-82520.md)
  `CVE-2026-82520` · CVE record: domainaware parsedmarc · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-409
- [ffuf denial of service (OOM) via HTTP response decompression bomb](https://agentprime.io/advisories/GHSA-jcvh-xf52-2cwm.md)
  `GHSA-jcvh-xf52-2cwm`, `CVE-2026-73232`, `GO-2026-6369` · Go `github.com/ffuf/ffuf` and 1 more: affected `<=1.5.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-409
- [Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits](https://agentprime.io/advisories/GHSA-928x-9mpw-8h56.md)
  `GHSA-928x-9mpw-8h56`, `CVE-2026-61455`, `CVE-2026-61690`, `PKSA-2vrn-cxz9-yg23` · Packagist `getgrav/grav`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-409
- [Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service](https://agentprime.io/advisories/CVE-2026-78594.md)
  `CVE-2026-78594` · CVE record: Elastic Apm Server · CVSS 4.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-409
- [Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72628.md)
  `CVE-2026-72628` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-409
- [MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS](https://agentprime.io/advisories/GHSA-rgwj-5xj2-c3m3.md)
  `GHSA-rgwj-5xj2-c3m3` · npm `mysql2`: affected `<3.23.1`, fixed in `3.23.1` · CVSS 5.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-409
- [Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun](https://agentprime.io/advisories/CVE-2026-58107.md)
  `CVE-2026-58107` · CVE record: Ericsson CodeChecker · CVSS 5.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service, CWE-409
- [Unbounded decompression in UnZipTransformer enables zip-bomb DoS](https://agentprime.io/advisories/CVE-2026-59274.md)
  `CVE-2026-59274` · CVE record: Spring Spring Integration · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-409
- [http4s has HTTP/2 Denial of Service with Ember Backend](https://agentprime.io/advisories/GHSA-vmm3-xgcx-67hm.md)
  `GHSA-vmm3-xgcx-67hm`, `CVE-2026-54556` · Maven `org.http4s:http4s-ember-core_2.12` and 2 more: affected `<0.23.35`, fixed in `0.23.35` · CVSS 8.2 High · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-409
- [LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction](https://agentprime.io/advisories/CVE-2026-80189.md)
  `CVE-2026-80189` · CVE record: perber leafwiki · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-409
- [gRPC Erlang package has unbounded gzip decompression (decompression bomb)](https://agentprime.io/advisories/GHSA-6ccx-9c9f-327w.md)
  `GHSA-6ccx-9c9f-327w`, `CVE-2026-53430`, `EEF-CVE-2026-53430` · Hex `grpc`: affected `>=0.4.0, <1.0.0`, fixed in `1.0.0` · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-409
- [exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression](https://agentprime.io/advisories/CVE-2026-78206.md)
  `CVE-2026-78206` · CVE record: exceljs exceljs · CVSS 8.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-409
- [WeeChat has a Decompression Bomb in Relay WebSocket (DoS)](https://agentprime.io/advisories/CVE-2026-53524.md)
  `CVE-2026-53524` · CVE record: weechat weechat · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-409
- [Tanium addressed a compression bomb vulnerability in Findings.](https://agentprime.io/advisories/CVE-2026-11617.md)
  `CVE-2026-11617` · CVE record: Tanium Findings · CVSS 3.1 Low · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-409
- [Tanium addressed a compression bomb vulnerability in Threat Response.](https://agentprime.io/advisories/CVE-2026-75476.md)
  `CVE-2026-75476` · CVE record: Tanium Threat Response · CVSS 3.1 Low · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-409
- [Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java](https://agentprime.io/advisories/CVE-2026-75936.md)
  `CVE-2026-75936` · CVE record: Amazon Ion Amazon Ion Java · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-409
- [Improper handling of highly compressed data (data amplification) in CISA Malcolm](https://agentprime.io/advisories/CVE-2026-19671.md)
  `CVE-2026-19671` · CVE record: CISAgov Malcolm · CVSS 7.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-409
- [Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb](https://agentprime.io/advisories/CVE-2026-74046.md)
  `CVE-2026-74046` · CVE record: Wazuh wazuh-manager · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-409
- [Resource Exhaustion in Carbone](https://agentprime.io/advisories/CVE-2026-18929.md)
  `CVE-2026-18929` · CVE record: Carbone Carbone · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-409
- [http4k: Unbounded gzip decompression in \`ServerFilters.GZip\` / \`RequestFilters.GunZip\` allowed memory-exhaustion DoS](https://agentprime.io/advisories/GHSA-g4w2-6h2r-3m3w.md)
  `GHSA-g4w2-6h2r-3m3w`, `CVE-2026-53659` · Maven `org.http4k:http4k-core`: affected `>=6.0.0.0, <6.49.0.0 || >=5.0.0.0, <5.42.0.0 || <=4.48.2.0`, fixed in `6.49.0.0`, `5.42.0.0` · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-409
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…](https://agentprime.io/advisories/CVE-2026-75047.md)
  `CVE-2026-75047` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-409
- [Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost](https://agentprime.io/advisories/CVE-2026-14298.md)
  `CVE-2026-14298` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-409
- [Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests](https://agentprime.io/advisories/CVE-2026-68981.md)
  `CVE-2026-68981` · CVE record: Apache Software Foundation Apache NiFi · CVSS 8.8 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-409
- [Mattermost Server Denial of Service via Animated GIF Emoji Upload](https://agentprime.io/advisories/CVE-2026-10819.md)
  `CVE-2026-10819` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-409
- [Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability](https://agentprime.io/advisories/GHSA-6pjx-3pjc-mrj8.md)
  `GHSA-6pjx-3pjc-mrj8`, `BIT-thrift-2026-41608`, `CVE-2026-41608`, `PYSEC-2026-3925` · PyPI `thrift`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-409
- [Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb](https://agentprime.io/advisories/CVE-2026-49158.md)
  `CVE-2026-49158` · CVE record: Apache Software Foundation Apache Thrift · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-409
- [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit](https://agentprime.io/advisories/CVE-2026-48586.md)
  `CVE-2026-48586` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-409
- [OmniFaces: Forged combined-resource IDs and related output/push boundaries](https://agentprime.io/advisories/GHSA-fp43-vj7g-pg92.md)
  `GHSA-fp43-vj7g-pg92`, `CVE-2026-102695` · Maven `org.omnifaces:omnifaces`: affected `<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2`, fixed in `1.14.3`, `2.7.33`, `3.14.23`, `4.7.12`, `5.4.2` · CVSS 8.2 High · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), Information disclosure, Denial of service, Broken access control
- [Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server](https://agentprime.io/advisories/GHSA-g9j2-8w95-3vwv.md)
  `GHSA-g9j2-8w95-3vwv`, `CVE-2026-55497`, `GO-2026-6100` · Go `github.com/cloudreve/Cloudreve/v3` and 1 more: affected `<=3.0.0-20250225100611-da4e44b77af4`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, CWE-409
- [httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling](https://agentprime.io/advisories/GHSA-j5g9-f88f-gfj3.md)
  `GHSA-j5g9-f88f-gfj3`, `CVE-2026-59939`, `PYSEC-2026-3444` · PyPI `httplib2`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service, CWE-409
- [PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion](https://agentprime.io/advisories/GHSA-2mrg-gjxq-2gvr.md)
  `GHSA-2mrg-gjxq-2gvr`, `CVE-2026-59932`, `PKSA-m9cr-9614-rsf7` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1`, fixed in `1.30.6`, `2.1.18`, `2.4.7`, `3.10.7`, `5.8.1` · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Denial of service, CWE-409
- [Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload](https://agentprime.io/advisories/GHSA-6hm7-3pwj-22rm.md)
  `GHSA-6hm7-3pwj-22rm`, `CVE-2026-56755`, `GO-2026-6037` · Go `code.gitea.io/gitea`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 6.2 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, CWE-409
- [Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport](https://agentprime.io/advisories/CVE-2026-62963.md)
  `CVE-2026-62963` · CVE record: centrifugal centrifugo · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-409
- [adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files](https://agentprime.io/advisories/GHSA-xg43-5579-qw6v.md)
  `GHSA-xg43-5579-qw6v`, `PKSA-zwm1-4dcx-xx1p` · Packagist `adawolfa/isdoc`: affected `* || >=1.4.0, <1.4.3 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1`, fixed in `1.4.3`, `1.5.1`, `1.6.1` · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service, CWE-409
- [Duplicate Advisory: Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer](https://agentprime.io/advisories/GHSA-v626-428r-43p8.md)
  `GHSA-v626-428r-43p8` · Packagist `getgrav/grav`: affected `=2.0.1`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-409
- [Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service](https://agentprime.io/advisories/CVE-2026-15709.md)
  `CVE-2026-15709` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-409
- [An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console.](https://agentprime.io/advisories/CVE-2026-12588.md)
  `CVE-2026-12588` · CVE record: Trellix Trellix HX Console · CVSS 6.0 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-409
- [HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter](https://agentprime.io/advisories/CVE-2026-58486.md)
  `CVE-2026-58486` · CVE record: hedgedoc hedgedoc · CVSS 8.3 High · Not analysed yet · Published 13 Jul 2026 · Tags: Denial of service, CWE-409

Newest: <https://agentprime.io/advisories/tag/cwe-409.md>
Older: <https://agentprime.io/advisories/tag/cwe-409.md?cursor=WyIyMDI2LTA3LTEzVDIyOjEyOjM3LjgzNzAwMFoiLCJDVkUtMjAyNi01ODQ4NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-409&cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjI4LjAwMDAwMFoiLCJHSFNBLWh4cDktdzh4My1wNTY2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-409/?cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjI4LjAwMDAwMFoiLCJHSFNBLWh4cDktdzh4My1wNTY2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.