Common Weakness Enumeration

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Description

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-409 ordered by modification date.

25 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-w7jp-mf2v-8342	CVE-2026-91979	HIGH	golang/code.vikunja.io/api	Vikunja: Denial of service via decompression bomb in the data import	2026-10-09
GHSA-x8v2-478q-2hvg	CVE-2026-107227	HIGH	maven/org.asynchttpclient/async-http-client	AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled	2026-10-08
GHSA-xv6h-r36f-3gp5	CVE-2026-2575	MODERATE	maven/org.keycloak/keycloak-saml-adapter-core maven/org.keycloak/keycloak-saml-core maven/org.keycloak/keycloak-services	Keycloak: Denial of Service due to excessive SAMLRequest decompression	2026-10-06
GHSA-3cr3-8m4c-fpxw	CVE-2026-105747	MODERATE	pypi/docling pypi/docling-slim	Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)	2026-10-06
GHSA-f4ch-vxwc-3p2m	-	MODERATE	pypi/docling	Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)	2026-10-06
GHSA-cjcg-cxmh-9wcr	-	HIGH	-	Praxis affected by HTTP/2 Bomb	2026-10-02
GHSA-mcm9-63f2-9j32	-	HIGH	npm/devalue	devalue: Repeated primitive strings cause quadratic expansion in uneval	2026-10-01
GHSA-chx6-46f5-w4vp	-	HIGH	pypi/tornado	tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM	2026-09-30
GHSA-rcw4-f5rp-g42v	-	HIGH	npm/adm-zip	adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0	2026-09-29
GHSA-2xpw-w6gg-jr37	CVE-2025-66471	HIGH	pypi/urllib3	urllib3 streaming API improperly handles highly compressed data	2026-09-25
GHSA-hxp9-w8x3-p566	CVE-2026-77528	MODERATE	pypi/autobahn pypi/crossbar	Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation	2026-09-22
GHSA-3w98-rrpr-fprr	CVE-2026-81875	HIGH	maven/ca.uhn.hapi.fhir/org.hl7.fhir.r5 maven/ca.uhn.hapi.fhir/org.hl7.fhir.validation maven/ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli	HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service	2026-09-17
GHSA-7grg-jcf7-rpmx	CVE-2026-85721	HIGH	maven/org.asynchttpclient/async-http-client	AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service	2026-09-17
GHSA-v626-428r-43p8	-	HIGH	-	Duplicate Advisory: Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer	2026-09-17
GHSA-2vcx-h8p2-9pg9	CVE-2026-59193	MODERATE	-	Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()	2026-09-16
GHSA-8cp2-47hg-mfgh	CVE-2026-69304	MODERATE	nuget/Microsoft.AspNetCore.Server.IISIntegration	Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability	2026-09-09
GHSA-v3f6-m9j2-437p	-	MODERATE	nuget/Microsoft.AspNetCore.Server.IISIntegration	Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability	2026-09-08
GHSA-8xx6-hgc6-gc2m	CVE-2026-84382	HIGH	pypi/httpx2	HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)	2026-09-08
GHSA-jcvh-xf52-2cwm	CVE-2026-73232	HIGH	golang/github.com/ffuf/ffuf golang/github.com/ffuf/ffuf/v2	ffuf denial of service (OOM) via HTTP response decompression bomb	2026-09-03
GHSA-928x-9mpw-8h56	CVE-2026-61690	MODERATE	-	Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits	2026-09-02
GHSA-rgwj-5xj2-c3m3	-	MODERATE	npm/mysql2	MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS	2026-09-02
GHSA-6pjx-3pjc-mrj8	CVE-2026-41608	HIGH	pypi/thrift	Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability	2026-09-01
GHSA-vmm3-xgcx-67hm	CVE-2026-54556	HIGH	maven/org.http4s/http4s-ember-core_2.12 maven/org.http4s/http4s-ember-core_2.13 maven/org.http4s/http4s-ember-core_3	http4s has HTTP/2 Denial of Service with Ember Backend	2026-08-26
GHSA-6ccx-9c9f-327w	CVE-2026-53430	HIGH	-	gRPC Erlang package has unbounded gzip decompression (decompression bomb)	2026-08-25
GHSA-j5g9-f88f-gfj3	CVE-2026-59939	HIGH	pypi/httplib2	httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling	2026-08-20