agentprime: CWE-409

CVE-2026-84161: Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics

Fri, 06 Nov 2026 10:48:16 GMT

CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Thu, 05 Nov 2026 20:15:56 GMT

ezstd >=1.0.5, <1.2.5, fixed in 1.2.5. CVSS 6.9 (Medium). Published by OSV. Not analysed by agentprime yet.

CVE-2026-122323: Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression

Thu, 05 Nov 2026 02:25:21 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-122322: Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

Thu, 05 Nov 2026 02:25:20 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-65059: Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

Mon, 02 Nov 2026 17:01:28 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-117677: Gitea Helm chart upload decompression denial of service

Sun, 01 Nov 2026 09:48:45 GMT

Published by the CVE Program. Not analysed by agentprime yet.

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Fri, 30 Oct 2026 23:13:38 GMT

github.com/kubeflow/pipelines <0.0.0-20260831164314-ba9ae72cc860, fixed in 0.0.0-20260831164314-ba9ae72cc860. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Wed, 28 Oct 2026 21:10:17 GMT

autobahn >=26.7.1, <26.10.1, fixed in 26.10.1. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

Wed, 28 Oct 2026 16:37:58 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116662: Tanium addressed a compression bomb vulnerability in Enforce.

Tue, 27 Oct 2026 17:33:33 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Mon, 26 Oct 2026 19:53:16 GMT

jose >=1.0.0, <1.11.13, fixed in 1.11.13. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-93850: Unbounded memory consumption during PDF text extraction

Mon, 26 Oct 2026 14:26:56 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Unbounded response body buffering and decompression in hackney

Mon, 26 Oct 2026 13:49:40 GMT

hackney >=2.0.0-beta.1, <4.9.0, fixed in 4.9.0. CVSS 8.2 (High). Published by OSV. Not analysed by agentprime yet.

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Mon, 26 Oct 2026 13:32:22 GMT

bandit >=0.3.3, <1.14.0, fixed in 1.14.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-116175: vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

Sun, 25 Oct 2026 13:20:15 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Echo: Decompress permits unbounded gzip expansion in v4

Fri, 23 Oct 2026 20:49:49 GMT

github.com/labstack/echo/v4 >=4.0.0, <4.16.1, fixed in 4.16.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-115638: OpenStack Ironic: OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results…

Fri, 23 Oct 2026 03:21:17 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-115503: Ghidra before 12.2 Denial of Service via Compressed Extension Archive

Thu, 22 Oct 2026 19:14:03 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-115396: Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive

Thu, 22 Oct 2026 19:14:01 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-113873: SmileCDR HAPI FHIR improper data decompression

Thu, 22 Oct 2026 17:57:52 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

Django REST framework: JSONParser applies an attacker-named codec to the request stream

Thu, 22 Oct 2026 16:16:09 GMT

djangorestframework >=3.6.4, <3.18.2, fixed in 3.18.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

Thu, 22 Oct 2026 15:57:17 GMT

pillow <13.0.0, fixed in 13.0.0. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Thu, 22 Oct 2026 15:56:37 GMT

pillow <13.0.0, fixed in 13.0.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Unbounded SAML message decompression in esaml allows memory exhaustion

Thu, 22 Oct 2026 06:59:24 GMT

esaml >=0.1.0, no fixed version yet. CVSS 8.7 (High). Published by OSV. Not analysed by agentprime yet.

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Wed, 21 Oct 2026 21:12:56 GMT

pillow >=4.1.0, <13.0.0, fixed in 13.0.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-92823: Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

Wed, 21 Oct 2026 03:18:37 GMT

CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session

Tue, 20 Oct 2026 15:39:23 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-111924: Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression

Sat, 17 Oct 2026 18:46:37 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102477: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0…

Thu, 15 Oct 2026 08:28:25 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102072: Junos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabled

Wed, 14 Oct 2026 16:16:17 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-95502: Git Sync memory exhaustion via a malicious Git server

Tue, 13 Oct 2026 17:05:49 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97334: Network messaging layer decompression resource exhaustion

Tue, 13 Oct 2026 14:27:01 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

hex_core decompresses registry and Erlang term API responses without size limits

Mon, 12 Oct 2026 16:43:58 GMT

hex_core >=0.1.0, <0.20.0, fixed in 0.20.0. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-109324: Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

Mon, 12 Oct 2026 16:05:15 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109294: Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Mon, 12 Oct 2026 16:04:54 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-96618: Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Mon, 12 Oct 2026 15:29:19 GMT

CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109398: Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs

Mon, 12 Oct 2026 15:16:43 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109229: SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

Mon, 12 Oct 2026 14:04:32 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109226: SGLang through 0.5.21 Audio Decompression Amplification via load_audio

Mon, 12 Oct 2026 14:04:30 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108750: OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

Sun, 11 Oct 2026 12:19:50 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Vikunja: Denial of service via decompression bomb in the data import

Fri, 09 Oct 2026 20:52:52 GMT

code.vikunja.io/api <2.6.0, fixed in 2.6.0. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

Fri, 09 Oct 2026 10:18:00 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107335: Improper Handling of Highly Compressed Data in Malcolm

Thu, 08 Oct 2026 17:30:12 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Thu, 08 Oct 2026 16:49:53 GMT

org.asynchttpclient:async-http-client >=3.0.0, <3.0.14 || >=2.2.0, <=2.16.1, fixed in 3.0.14. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-107210: ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data

Wed, 07 Oct 2026 15:59:42 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-106585: OpenBSD OpenSSH: In sshd and ssh in OpenSSH before 10.6…

Tue, 06 Oct 2026 20:52:39 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Tue, 06 Oct 2026 13:41:16 GMT

docling >=2.45.0, <2.131.0, fixed in 2.131.0. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

Tue, 06 Oct 2026 00:32:49 GMT

docling >=2.45.0, <2.131.0, fixed in 2.131.0. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Praxis affected by HTTP/2 Bomb

Fri, 02 Oct 2026 23:09:37 GMT

praxis-proxy <0.5.2, fixed in 0.5.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-66054: Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize

Fri, 02 Oct 2026 12:58:05 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.