Improper Handling of Highly Compressed Data (Data Amplification)

Every one of the 188 is a mark on the map. Named now: 1 to 26, most at risk first.

1. urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441urllib3 · CVSS 7.5 · 2.9% likely

   Urllib3

2. .NET and Visual Studio Denial of Service VulnerabilityCVE-2024-43499Microsoft · CVSS 7.5 · 2.6% likely

   Microsoft

3. Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)CVE-2024-28180go-jose · CVSS 4.3 · 2.0% likely

   Go-Jose

4. The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes large…CVE-2017-16129HackerOne · 1.7% likely

   HackerOne

5. Zip bomb vulnerability in EnvoyCVE-2022-29225envoyproxy · CVSS 7.5 · 1.6% likely

   Envoyproxy

6. Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)CVE-2026-89059Red Hat · CVSS 7.5 · 1.5% likely

   Red Hat

7. undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionCVE-2026-1526undici · CVSS 7.5 · 1.3% likely

   Undici

8. In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointCVE-2026-75047JetBrains · CVSS 6.5 · 1.2% likely

   JetBrains

9. Apache Thrift: Ruby THeaderTransport ZLIB Decompression BombCVE-2026-49158Apache Software Foundation · CVSS 7.5 · 1.0% likely

   Apache

10. Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitCVE-2026-48586Apache Software Foundation · CVSS 8.7 · 1.0% likely

    Apache

11. Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransportCVE-2026-41608Apache Software Foundation · CVSS 7.5 · 1.0% likely

    Apache

12. gosaml2 vulnerable to Denial of Service via deflate decompression bombCVE-2023-26483russellhaering · CVSS 5.3 · 1.0% likely
13. Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of serviceCVE-2026-15709Red Hat · CVSS 7.5 · 1.0% likely

    Red Hat

14. ASP.NET Core Denial of Service VulnerabilityCVE-2026-69304Microsoft · CVSS 5.9 · 0.9% likely

    Microsoft

15. Suricata http2: decompression bomb can cause denial of service in SuricataCVE-2026-46387OISF · CVSS 7.5 · 0.9% likely

    OISF

16. XML External Entity (XXE) Vulnerability in scrapy/scrapyCVE-2024-3572scrapy · CVSS 7.5 · 0.8% likely

    Scrapy

17. Nomad Client Vulnerable to Decompression Bombs in Artifact BlockCVE-2023-0821HashiCorp · CVSS 6.5 · 0.8% likely

    HashiCorp

18. parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email AttachmentsCVE-2026-82520domainaware · CVSS 7.5 · 0.8% likely
19. Denial of Service in h2oai/h2o-3CVE-2024-7765h2oai · CVSS 7.5 · 0.8% likely

    H2oai

20. Apollo Router's Compressed Payloads do not respect HTTP Payload LimitsCVE-2024-28101apollographql · CVSS 7.5 · 0.8% likely

    Apollographql

21. Improper Input Validation in binary-husky/gpt_academicCVE-2024-12387binary-husky · CVSS 6.5 · 0.7% likely

    Binary-Husky

22. Pre-auth SSH DoS via unbounded zlib inflateCVE-2026-23943Erlang · CVSS 6.9 · 0.7% likely

    Erlang

23. Netdata: WebSocket Decompression BombCVE-2026-83599netdata · CVSS 7.5 · 0.7% likely

    Netdata

24. rpcx - Denial of Service via Gzip Decompression Bomb in Wire ProtocolCVE-2026-59803smallnest · CVSS 7.5 · 0.7% likely
25. Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsCVE-2026-68981Apache Software Foundation · CVSS 8.8 · 0.7% likelycovered by CyberSIXT

    Apache

26. Out-Of-Memory (OOM) Vulnerability in ollama/ollamaCVE-2024-12886ollama · CVSS 7.5 · 0.7% likely

    Ollama

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.