CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
83 CVEs classified under CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification)). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27809 | Critical | 9.1 | 2026-02-26 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.12.2, when a PSD file contains malformed RLE-compressed image data… |
CVE-2026-44697 | High | 8.6 | 2026-05-29 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decom… |
CVE-2026-49855 | High | 7.5 | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but di… |
CVE-2026-15709 | High | 7.5 | 2026-07-14 | A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes da… |
CVE-2026-44160 | High | 7.5 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and… |
CVE-2026-59939 | High | 7.5 | 2026-07-08 | httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Con… |
CVE-2026-59803 | High | 7.5 | 2026-07-08 | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has th… |
CVE-2026-24264 | High | 7.5 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit… |
CVE-2026-48044 | High | 7.5 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability… |
CVE-2026-54314 | High | 7.5 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into mem… |
CVE-2026-48510 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it… |
CVE-2026-48502 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attac… |
CVE-2026-54278 | High | 7.5 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to… |
CVE-2026-47774 | High | 7.5 | 2026-06-17 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability i… |
CVE-2026-49975 | High | 7.5 | 2026-06-08 | Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue… |
CVE-2026-10725 | High | 7.5 | 2026-06-06 | Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small H… |
CVE-2026-44432 | High | 7.5 | 2026-05-13 | urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) duri… |
CVE-2026-40192 | High | 7.5 | 2026-04-15 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making the… |
CVE-2026-40036 | High | 7.5 | 2026-04-08 | Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. At… |
CVE-2026-29785 | High | 7.5 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has th… |