CWE-409

89 vulnerabilities with CWE-409

CVE-2026-23943 MEDIUM

Erlang/OTP 17.0-28.4.1 - Denial of Service via SSH Compression Bomb

CVSS 5.3

CVE-2026-1526 HIGH

undici < 6.24.0 and 7.0.0-7.24.0 - Denial of Service via PerMessageDeflate Decompression Bomb

CVSS 7.5

CVE-2026-25962 MEDIUM

Markus < 2.9.4 - Denial of Service via Unrestricted Zip Extraction

CVSS 6.5

CVE-2026-28435 HIGH

cpp-httplib < 0.35.0 - Uncontrolled Resource Consumption via Decompressed Request Body Bypass

CVSS 7.5

CVE-2026-27809 CRITICAL

psd-tools < 1.12.2 - Denial of Service via Malformed RLE-Compressed Image Data

CVSS 9.1

CVE-2026-27571 MEDIUM

NATS-Server < 2.11.2 and 2.12.3 - Unauthenticated Denial of Service via WebSocket Compression Bomb

CVSS 5.9

CVE-2026-22870 HIGH

datadoghq/guarddog < 2.7.1 - Denial of Service via ZIP Bomb Extraction

CVSS 7.5

CVE-2026-22776 HIGH

cpp-httplib < 0.30.1 - Denial of Service via Unbounded Decompression of HTTP Request Bodies

CVSS 7.5

CVE-2026-21441 HIGH

urllib3 1.22-2.6.2 - Denial of Service via HTTP Redirect Response Decompression

CVSS 7.5

CVE-2025-69223 HIGH

aiohttp < 3.13.3 - Denial of Service via Zip Bomb Decompression

CVSS 7.5

CVE-2025-66909 HIGH

Turms AI-Serving module <= 0.10.0-SNAPSHOT - Unauthenticated Denial of Service via Image Decompression Bomb

CVSS 7.5

CVE-2025-66471 HIGH

urllib3 1.0-2.5.9 - Denial of Service via Highly Compressed Data Handling

CVSS 7.5

CVE-2025-66019 MEDIUM

pypdf < 6.4.0 - Uncontrolled Resource Consumption via LZWDecode Filter

CVE-2025-63914 MEDIUM

Cinnamon kotaemon 0.11.0 - Info Disclosure

CVSS 6.5

CVE-2025-62708 HIGH

pypdf < 6.1.3 - Denial of Service via LZWDecode Filter

CVSS 7.5

CVE-2025-58057 HIGH

Netty < 4.1.125 - Denial of Service via BrotliDecoder Decompression

CVSS 7.5

CVE-2025-46730 MEDIUM

Mobile Security Framework <= 4.3.2 - Denial of Service via ZIP Bomb Extraction

CVSS 6.8

CVE-2025-32949 MEDIUM

PeerTube < 7.1.1 - Authenticated Disk Space Exhaustion via Zip Bomb Extraction

CVSS 6.5

CVE-2025-0986 MEDIUM

IBM PowerVM Hypervisor - Info Disclosure

CVSS 4.5

CVE-2025-30153 HIGH

kin-openapi < 0.131.0 - Denial of Service via ZIP Bomb in Multipart Form Data

CVSS 7.5

CVE-2025-25186 MEDIUM

Net::IMAP 0.3.2-0.3.7, 0.4.0-0.4.18, 0.5.0-0.5.5 - Denial of Service via Memory Exhaustion in Response Parser

CVSS 6.5

CVE-2024-29370 MEDIUM

python-jose < 3.4.0 - Denial of Service via Malicious JWE Token Decompression

CVSS 5.3

CVE-2024-55909 MEDIUM

IBM Concert 1.0.0-1.0.5 - Authenticated Denial of Service via Archive Expansion

CVSS 6.5

CVE-2024-7765 HIGH

h2o 3.46.0.2 - Denial of Service via GZIP File Parsing

CVSS 7.5

CVE-2024-12886 HIGH

ollama 0.3.14 - Denial of Service via Gzip Bomb HTTP Response

CVSS 7.5