CWE-409.

Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

• CWE-409

>=1.0.5, <1.2.5 · fixed in 1.2.5

Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression

• kyverno
• CWE-409

Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

• kyverno
• CWE-409

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

• CWE-409

Gitea Helm chart upload decompression denial of service

• Gitea
• Denial of service
• CWE-409

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

• CWE-409

<0.0.0-20260831164314-ba9ae72cc860 · fixed in 0.0.0-20260831164314-ba9ae72cc860

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

• Denial of service
• CWE-409

>=26.7.1, <26.10.1 · fixed in 26.10.1

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

• Apache Software Foundation Apache Kafka
• Denial of service
• CWE-409

Tanium addressed a compression bomb vulnerability in Enforce.

• Tanium Enforce
• CWE-409

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

• CWE-409

>=1.0.0, <1.11.13 · fixed in 1.11.13

Unbounded memory consumption during PDF text extraction

• Mattermost
• CWE-409

Unbounded response body buffering and decompression in hackney

• Denial of service
• CWE-409

>=2.0.0-beta.1, <4.9.0 · fixed in 4.9.0

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

• CWE-409

>=0.3.3, <1.14.0 · fixed in 1.14.0

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

• vllm
• CWE-409

Echo: Decompress permits unbounded gzip expansion in v4

• Denial of service
• CWE-409

>=4.0.0, <4.16.1 · fixed in 4.16.1

OpenStack Ironic: OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results…

• OpenStack Ironic
• CWE-409

Ghidra before 12.2 Denial of Service via Compressed Extension Archive

• NationalSecurityAgency ghidra
• CWE-409

Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive

• NationalSecurityAgency ghidra
• CWE-409

SmileCDR HAPI FHIR improper data decompression

• SmileCDR HAPI FHIR
• CWE-409

Django REST framework: JSONParser applies an attacker-named codec to the request stream

• Denial of service
• CWE-409

>=3.6.4, <3.18.2 · fixed in 3.18.2

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

• Denial of service
• CWE-409

<13.0.0 · fixed in 13.0.0

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

• Denial of service
• CWE-409

<13.0.0 · fixed in 13.0.0

Unbounded SAML message decompression in esaml allows memory exhaustion

• CWE-409

>=0.1.0 · no fixed version yet

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

• CWE-409

>=4.1.0, <13.0.0 · fixed in 13.0.0

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-409

Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

• Apache Software Foundation Apache CouchDB
• CWE-409

Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

• fleet
• CWE-409

Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0…

• Eclipse Foundation Eclipse Vert.x
• CWE-409

Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled

• Juniper Networks Junos OS
• CWE-409

Git Sync memory exhaustion via a malicious Git server

• Grafana Nanogit
• Grafana OSS
• Denial of service
• CWE-409

Network messaging layer decompression resource exhaustion

• Commvault Cloud
• CWE-409

hex_core decompresses registry and Erlang term API responses without size limits

• CWE-409

>=0.1.0, <0.20.0 · fixed in 0.20.0

Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

• grav
• CWE-409

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

• open-webui
• Denial of service
• CWE-409

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

• hex
• Denial of service
• CWE-409

Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

• gumlet php-image-resize
• CWE-409

SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

• sgl-project sglang
• CWE-409

SGLang through 0.5.21 Audio Decompression Amplification via load_audio

• sgl-project sglang
• CWE-409

OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

• OpenDocMan
• CWE-409

Vikunja: Denial of service via decompression bomb in the data import

• Denial of service
• CWE-409

<2.6.0 · fixed in 2.6.0

Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

• Apache Software Foundation Apache CXF
• CWE-409

Improper Handling of Highly Compressed Data in Malcolm

• CISA Malcolm
• CWE-409

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

• Denial of service
• CWE-409

>=3.0.0, <3.0.14 || >=2.2.0, <=2.16.1 · fixed in 3.0.14

ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data

• ImageMagick
• CWE-409

OpenBSD OpenSSH: In sshd and ssh in OpenSSH before 10.6…

• OpenBSD OpenSSH
• CWE-409

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

• Denial of service
• CWE-409

>=2.45.0, <2.131.0 · fixed in 2.131.0

Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

• CWE-409

>=2.45.0, <2.131.0 · fixed in 2.131.0

Praxis affected by HTTP/2 Bomb

• CWE-409

<0.5.2 · fixed in 0.5.2

Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

• Apache Software Foundation Apache Thrift
• Denial of service
• CWE-409

Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame

• Apache Software Foundation Apache Thrift
• CWE-409

Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

• Apache Software Foundation Apache Thrift
• CWE-409
• CWE-628

devalue: Repeated primitive strings cause quadratic expansion in uneval

• Denial of service
• CWE-409

<5.9.3 · fixed in 5.9.3

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

• Denial of service
• CWE-409

<6.5.9 · fixed in 6.5.9

Fireware OS Resource Exhaustion in Login Process Allows Denial of Service

• WatchGuard Fireware OS
• Denial of service
• CWE-409

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

• CWE-409

<0.6.1 · fixed in 0.6.1

Nicotine+: Decompression of peer messages can exhaust available memory

• nicotine-plus
• CWE-409

Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

• Apache Software Foundation Apache Qpid Broker-J
• CWE-409

Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

• docmost
• Denial of service
• CWE-409

RabbitMQ: Web-MQTT decompression bomb

• rabbitmq-server
• CWE-409

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

• Denial of service
• CWE-409

<26.7.1 · fixed in 26.7.1