CWE-409 · Denial of Service
Improper Handling of Highly Compressed Data (Data Amplification)
188CVEs
SortMost likely exploited
188 CVEs with CWE-409 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-21441urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)urllib3 · urllib3 · CVSS 7.5 · 2026-01-07 | 7.5 | 2.9% | 2026-01-07 |
| CVE-2024-43499.NET and Visual Studio Denial of Service VulnerabilityMicrosoft · Microsoft Visual Studio 2022 version 17.6 · CVSS 7.5 · 2024-11-12 | 7.5 | 2.6% | 2024-11-12 |
| CVE-2024-28180Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)go-jose · go-jose · CVSS 4.3 · 2024-03-09 | 4.3 | 2.0% | 2024-03-09 |
| CVE-2017-16129The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes large…HackerOne · superagent node module · 2018-06-07 | – | 1.7% | 2018-06-07 |
| CVE-2022-29225Zip bomb vulnerability in Envoyenvoyproxy · envoy · CVSS 7.5 · 2022-06-09 | 7.5 | 1.6% | 2022-06-09 |
| CVE-2026-89059Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)Red Hat · RESTEasy · CVSS 7.5 · 2026-09-18 | 7.5 | 1.5% | 2026-09-18 |
| CVE-2026-1526undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompressionundici · undici · CVSS 7.5 · 2026-03-12 | 7.5 | 1.3% | 2026-03-12 |
| CVE-2026-75047In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointJetBrains · YouTrack · CVSS 6.5 · 2026-08-17 | 6.5 | 1.2% | 2026-08-17 |
| CVE-2026-49158Apache Thrift: Ruby THeaderTransport ZLIB Decompression BombApache Software Foundation · Apache Thrift · CVSS 7.5 · 2026-07-27 | 7.5 | 1.0% | 2026-07-27 |
| CVE-2026-48586Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitApache Software Foundation · Apache Thrift · CVSS 8.7 · 2026-07-27 | 8.7 | 1.0% | 2026-07-27 |
| CVE-2026-41608Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransportApache Software Foundation · Apache Thrift · CVSS 7.5 · 2026-07-27 | 7.5 | 1.0% | 2026-07-27 |
| CVE-2023-26483gosaml2 vulnerable to Denial of Service via deflate decompression bombrussellhaering · gosaml2 · CVSS 5.3 · 2023-03-03 | 5.3 | 1.0% | 2023-03-03 |
| CVE-2026-15709Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of serviceRed Hat · Red Hat Enterprise Linux 10 · CVSS 7.5 · 2026-07-14 | 7.5 | 1.0% | 2026-07-14 |
| CVE-2026-128242actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoderactix · actix-http · CVSS 7.5 · 2026-11-13 | 7.5 | 0.9% | 2026-11-13 |
| CVE-2026-69304ASP.NET Core Denial of Service VulnerabilityMicrosoft · .NET 10.0 runtime · CVSS 5.9 · 2026-09-08 | 5.9 | 0.9% | 2026-09-08 |
| CVE-2026-46387Suricata http2: decompression bomb can cause denial of service in SuricataOISF · suricata · CVSS 7.5 · 2026-09-10 | 7.5 | 0.9% | 2026-09-10 |
| CVE-2024-3572XML External Entity (XXE) Vulnerability in scrapy/scrapyscrapy · scrapy/scrapy · CVSS 7.5 · 2024-04-16 | 7.5 | 0.8% | 2024-04-16 |
| CVE-2023-0821Nomad Client Vulnerable to Decompression Bombs in Artifact BlockHashiCorp · Nomad · CVSS 6.5 · 2023-02-16 | 6.5 | 0.8% | 2023-02-16 |
| CVE-2026-82520parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachmentsdomainaware · parsedmarc · CVSS 7.5 · 2026-09-03 | 7.5 | 0.8% | 2026-09-03 |
| CVE-2024-7765Denial of Service in h2oai/h2o-3h2oai · h2oai/h2o-3 · CVSS 7.5 · 2025-03-20 | 7.5 | 0.8% | 2025-03-20 |
| CVE-2024-28101Apollo Router's Compressed Payloads do not respect HTTP Payload Limitsapollographql · router · CVSS 7.5 · 2024-03-06 | 7.5 | 0.8% | 2024-03-06 |
| CVE-2024-12387Improper Input Validation in binary-husky/gpt_academicbinary-husky · binary-husky/gpt_academic · CVSS 6.5 · 2025-03-20 | 6.5 | 0.7% | 2025-03-20 |
| CVE-2026-23943Pre-auth SSH DoS via unbounded zlib inflateErlang · OTP · CVSS 6.9 · 2026-03-13 | 6.9 | 0.7% | 2026-03-13 |
| CVE-2026-83599Netdata: WebSocket Decompression Bombnetdata · netdata · CVSS 7.5 · 2026-09-22 | 7.5 | 0.7% | 2026-09-22 |
| CVE-2026-59803rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocolsmallnest · rpcx · CVSS 7.5 · 2026-07-08 | 7.5 | 0.7% | 2026-07-08 |
| CVE-2026-68981Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsApache Software Foundation · Apache NiFi · CVSS 8.8 · 2026-08-03 | 8.8 | 0.7% | 2026-08-03 |
| CVE-2024-12886Out-Of-Memory (OOM) Vulnerability in ollama/ollamaollama · ollama/ollama · CVSS 7.5 · 2025-03-20 | 7.5 | 0.7% | 2025-03-20 |
| CVE-2025-66471urllib3 Streaming API improperly handles highly compressed dataurllib3 · urllib3 · CVSS 8.9 · 2025-12-05 | 8.9 | 0.7% | 2025-12-05 |
| CVE-2026-24264NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerabili…NVIDIA · Triton Inference Server · CVSS 7.5 · 2026-07-01 | 7.5 | 0.7% | 2026-07-01 |
| CVE-2026-2575Keycloak: keycloak: denial of service due to excessive samlrequest decompressionRed Hat · Red Hat build of Keycloak 26.4 · CVSS 5.3 · 2026-03-18 | 5.3 | 0.7% | 2026-03-18 |
| CVE-2026-121808Memory exhaustion via compressed Erlang terms in the elixir-grpc Erlpack codecelixir-grpc · grpc · CVSS 8.2 · 2026-11-13 | 8.2 | 0.7% | 2026-11-13 |
| CVE-2026-92000adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Sizecthackers · adm-zip · CVSS 7.5 · 2026-09-15 | 7.5 | 0.7% | 2026-09-15 |
| CVE-2026-44432urllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIurllib3 · urllib3 · CVSS 7.5 · 2026-05-13 | 7.5 | 0.7% | 2026-05-13 |
| CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionApache Software Foundation · Apache CouchDB · CVSS 7.7 · 2026-10-20 | 7.7 | 0.7% | 2026-10-20 |
| CVE-2026-59939httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handlinghttplib2 · httplib2 · CVSS 7.5 · 2026-07-08 | 7.5 | 0.7% | 2026-07-08 |
| CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 · esaml · CVSS 8.7 · 2026-10-22 | 8.7 | 0.7% | 2026-10-22 |
| CVE-2024-54016compression bomb attack in Apache Seata ServerApache Software Foundation · Apache Seata (incubating) · CVSS 4.3 · 2025-03-20 | 4.3 | 0.6% | 2025-03-20 |
| CVE-2025-58057Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attacknetty · netty · CVSS 6.9 · 2025-09-03 | 6.9 | 0.6% | 2025-09-03 |
| CVE-2026-85721AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceAsyncHttpClient · async-http-client · CVSS 7.5 · 2026-09-17 | 7.5 | 0.6% | 2026-09-17 |
| CVE-2026-84382HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)pydantic · httpx2 · CVSS 7.5 · 2026-09-02 | 7.5 | 0.6% | 2026-09-02 |
| CVE-2026-81875HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of servicehapifhir · org.hl7.fhir.core · CVSS 7.5 · 2026-09-16 | 7.5 | 0.6% | 2026-09-16 |
| CVE-2026-78206exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompressionexceljs · exceljs · CVSS 7.5 · 2026-08-24 | 7.5 | 0.6% | 2026-08-24 |
| CVE-2026-73232ffuf denial of service (OOM) via HTTP response decompression bombffuf · ffuf · CVSS 7.5 · 2026-08-11 | 7.5 | 0.6% | 2026-08-11 |
| CVE-2026-63452Suricata http1: repeated brotli compression bombs can cause excessive CPU consumptionOISF · suricata · CVSS 7.5 · 2026-09-18 | 7.5 | 0.6% | 2026-09-18 |
| CVE-2026-53659http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoShttp4k · http4k · CVSS 7.5 · 2026-09-14 | 7.5 | 0.6% | 2026-09-14 |
| CVE-2026-103262Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClienttornadoweb · tornado · CVSS 7.5 · 2026-10-01 | 7.5 | 0.6% | 2026-10-01 |
| CVE-2025-25186Net::IMAP vulnerable to possible DoS by memory exhaustionruby · net-imap · CVSS 6.5 · 2025-02-10 | 6.5 | 0.6% | 2025-02-10 |
| CVE-2026-70469Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsApache Software Foundation · Apache NiFi · CVSS 7.5 · 2026-09-16 | 7.5 | 0.6% | 2026-09-16 |
| CVE-2025-30153Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filtergetkin · kin-openapi · CVSS 7.5 · 2025-03-19 | 7.5 | 0.6% | 2025-03-19 |
| CVE-2026-44160Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`fluent · fluentd · CVSS 7.5 · 2026-07-08 | 7.5 | 0.6% | 2026-07-08 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.