CWE-409.

Netdata: WebSocket Decompression Bomb

• netdata
• CWE-409

Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

• vector
• CWE-409

Missing decompression size limit in agent receiver allows memory exhaustion via push agent data

• Checkmk
• CWE-409

Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

• Apache Software Foundation Apache MINA
• Denial of service
• CWE-409

Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

• OISF suricata
• Denial of service
• CWE-409

libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS

• strukturag libheif
• CWE-409

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

• Red Hat
• Red Hat Build of Apache Camel 3.33.4.redhat
• CWE-409

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

• Denial of service
• CWE-20

<6.9.12 · fixed in 6.9.12

AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

• Denial of service
• CWE-409

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

• CWE-409

>=2.0.1, <2.0.2 · fixed in 2.0.2

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

• CWE-409

>=1.0.0, <2.0.0 · fixed in 2.0.0

Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

• Apache Software Foundation Apache NiFi
• CWE-409

Unbounded zlib decompression in Calls SDP WebSocket messages

• Mattermost
• CWE-409

Uploading a crafted image causes excessive memory allocation in the Mattermost Server

• Mattermost
• CWE-409

Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened.

• Eclipse Foundation Eclipse OpenVSX
• CWE-409

vLLM before 0.28.0 Denial of Service via Audio Header

• vLLM
• CWE-409

Suricata http2: decompression bomb can cause denial of service in Suricata

• OISF suricata
• CWE-409

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

• CWE-409

>=8.0.0, <8.0.31 || >=9.0.0, <9.0.20 || >=10.0.0, <10.0.12 || >=11.0.0-preview.1, <11.0.0-rc.1 · fixed in 8.0.31, 9.0.20, 10.0.12, 11.0.0-rc.1

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerabili…

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• CWE-409

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

• CWE-409

<2.12.0 · fixed in 2.12.0

Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

• CWE-409

>=8.0.0, <8.0.31 || >=9.0.0, <9.0.20 || >=10.0.0, <10.0.12 || >=11.0.0-preview.1, <11.0.0-rc.1 · fixed in 8.0.31, 9.0.20, 10.0.12, 11.0.0-rc.1

Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

• Amazon ion-java
• CWE-409

parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments

• domainaware parsedmarc
• CWE-409

ffuf denial of service (OOM) via HTTP response decompression bomb

• CWE-409

<=1.5.0 · no fixed version yet

Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits

• CWE-409

<2.0.1 · fixed in 2.0.1

Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service

• Elastic Apm Server
• CWE-409

Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service

• Elastic Kibana
• CWE-409

MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

• CWE-409

<3.23.1 · fixed in 3.23.1

Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

• Ericsson CodeChecker
• Denial of service
• CWE-409

Unbounded decompression in UnZipTransformer enables zip-bomb DoS

• Spring Integration
• CWE-409

http4s has HTTP/2 Denial of Service with Ember Backend

• CWE-409

<0.23.35 · fixed in 0.23.35

LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction

• perber leafwiki
• CWE-409

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

• CWE-409

>=0.4.0, <1.0.0 · fixed in 1.0.0

exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression

• exceljs
• CWE-409

WeeChat has a Decompression Bomb in Relay WebSocket (DoS)

• weechat
• CWE-409

Tanium addressed a compression bomb vulnerability in Findings.

• Tanium Findings
• CWE-409

Tanium addressed a compression bomb vulnerability in Threat Response.

• Tanium Threat Response
• CWE-409

Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java

• Amazon Ion Java
• CWE-409

Improper handling of highly compressed data (data amplification) in CISA Malcolm

• CISAgov Malcolm
• CWE-409

Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

• wazuh-manager
• CWE-409

Resource Exhaustion in Carbone

• Carbone
• CWE-409

http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS

• CWE-409

>=6.0.0.0, <6.49.0.0 || >=5.0.0.0, <5.42.0.0 || <=4.48.2.0 · fixed in 6.49.0.0, 5.42.0.0

JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…

• JetBrains YouTrack
• CWE-409

Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

• Mattermost
• CWE-409

Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

• Apache Software Foundation Apache NiFi
• CWE-409

Mattermost Server Denial of Service via Animated GIF Emoji Upload

• Mattermost
• CWE-409

Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability

• CWE-409

<0.24.0 · fixed in 0.24.0

Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb

• Apache Software Foundation Apache Thrift
• CWE-409

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

• Apache Software Foundation Apache Thrift
• CWE-409

OmniFaces: Forged combined-resource IDs and related output/push boundaries

• Cross-site scripting (XSS)
• Information disclosure

<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2 · fixed in 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

• Denial of service
• CWE-409

<=3.0.0-20250225100611-da4e44b77af4 · no fixed version yet

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

• Denial of service
• CWE-409

<0.32.0 · fixed in 0.32.0

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

• Denial of service
• CWE-409

<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1 · fixed in 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

• Broken access control
• CWE-409

<1.27.0 · fixed in 1.27.0

Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

• centrifugal centrifugo
• CWE-409

adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files

• Denial of service
• CWE-409

* || >=1.4.0, <1.4.3 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1 · fixed in 1.4.3, 1.5.1, 1.6.1

Duplicate Advisory: Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer

• CWE-409

=2.0.1 · no fixed version yet

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-409

An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console.

• Trellix HX Console
• CWE-409

HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter

• hedgedoc
• Denial of service
• CWE-409