Advisories · Weakness
CWE-409.
Every Advisory and CVE whose sources give the weakness CWE-409, newest first.
- CVSS 6.8 Medium
Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack
- CWE-409
<=4.3.2 · no fixed version yet
GHSA-c5vg-26p8-q8cr · CVE-2025-46730 - CVSS 6.5 Medium
IBM Concert Software denial of service
- IBM Concert Software
- CWE-409
- CVSS 6.5 Medium
PeerTube User Import Authenticated Resource Exhaustion
- CWE-409
- CVSS 7.5 High
Ollama Vulnerable to Denial of Service (DoS) via Crafted GZIP in github.com/ollama/ollama
- CWE-409
<0.4.0-ci1 · fixed in 0.4.0-ci1
GHSA-v464-r2r9-www7 · CVE-2024-12886 - CVSS 4.5 Medium
IBM PowerVM Hypervisor data manipulation
- IBM PowerVM Hypervisor
- CWE-409
- CVSS 7.5 High
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
- CWE-409
>=3.32.1.2, <=3.46.0.2 · no fixed version yet
GHSA-6w62-3jvj-mfj6 · CVE-2024-7765 - CVSS 6.5 Medium
Improper Input Validation in binary-husky/gpt_academic
- binary-husky/gpt_academic
- CWE-409
- CVSS 4.3 Medium
Apache Seata Vulnerable to Data Amplification
- CWE-409
>=2.0.0, <2.3.0 · fixed in 2.3.0
GHSA-65vg-64g8-mwjr · CVE-2024-54016 - CVSS 7.5 High
Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter
- CWE-409
<0.131.0 · fixed in 0.131.0
GHSA-wq9g-9vfc-cfq9 · CVE-2025-30153 - CVSS 6.5 Medium
Possible DoS by memory exhaustion in net-imap
- Denial of service
- CWE-405
>=0.3.2, <0.3.8 || >=0.4.0, <0.4.19 || >=0.5.0, <0.5.6 · fixed in 0.3.8, 0.4.19, 0.5.6
GHSA-7fc5-f82f-cx69 · CVE-2025-25186 - CVSS 6.5 Medium
Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server
- CWE-409
>=9.5.0+incompatible, <9.5.13+incompatible || >=9.11.0+incompatible, <9.11.5+incompatible || >=10.0.0+incompatible, <10.0.3+incompatible || >=10.1.0+incompatible, <10.1.3+incompatible · fixed in 9.5.13+incompatible, 9.11.5+incompatible, 10.0.3+incompatible, 10.1.3+incompatible
GHSA-v647-h8jj-fw5r · CVE-2024-54682 - CVSS 7.5 High
.NET Denial of Service Vulnerability
- CWE-409
- CWE-606
<9.0.0 · fixed in 9.0.0
GHSA-6x36-qxmj-rv4p · CVE-2024-43499 - CVSS 7.5 High
Duplicate Advisory: .NET and Visual Studio Denial of Service Vulnerability
- CWE-409
- CWE-606
<9.0.0 · fixed in 9.0.0
GHSA-wmm6-pgp8-29hg - CVSS 6.5 Medium
Uncontrolled Resource Consumption in Hashicorp Nomad in github.com/hashicorp/nomad
- CWE-409
>=1.2.15, <1.2.16 || >=1.3.0, <1.3.9 || >=1.4.0, <1.4.4 · fixed in 1.2.16, 1.3.9, 1.4.4
GHSA-w479-w22g-cffh · CVE-2023-0821 - CVSS 4.3 Medium
Improper Handling of Highly Compressed Data (Data Amplification) in GitLab
- GitLab
- CWE-409
- CVSS 7.5 High
Duplicate Advisory: Scrapy decompression bomb vulnerability
- CWE-409
<2.11.1 · fixed in 2.11.1
GHSA-rmqv-7v3j-mr7p - CVSS 4.3 Medium
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
- CWE-409
<3.0.3 · fixed in 3.0.3
GHSA-c5q2-7r4c-mv6g · CVE-2024-28180 - CVSS 7.5 High
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
- CWE-409
>=0.9.5, <1.40.2 · fixed in 1.40.2
GHSA-cgqf-3cq5-wvcj · CVE-2024-28101 - CVSS 7.5 High
Scrapy decompression bomb vulnerability
- CWE-409
<1.8.4 || >=2.0.0, <2.11.1 · fixed in 1.8.4, 2.11.1
GHSA-7j7m-v7m3-jqm7 · CVE-2024-3572 - CVSS 5.3 Medium
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb
- CWE-409
<0.9.0 · fixed in 0.9.0
GHSA-6gc3-crp7-25w5 · CVE-2023-26483 - CVSS 4.2 Medium
Data Amplification in HashiCorp go-getter
- CWE-409
<1.7.0 · fixed in 1.7.0
GHSA-jpxj-2jvg-6jv9 · CVE-2023-0475 - CVSS 5.5 Medium
Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input
- Splunk Enterprise
- Splunk Universal Forwarders
- CWE-409
- CVSS 7.5 High
Zip bomb vulnerability in Envoy
- envoy
- Denial of service
- CWE-409
- CVSS 5.9 Medium
superagent vulnerable to zip bomb attacks
- Denial of service
- CWE-409
<3.7.0 · fixed in 3.7.0
GHSA-8225-6cvr-8pqp · CVE-2017-16129