CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

Parent: CWE-405 - Asymmetric Resource Consumption (Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

89 vulnerabilities with CWE-409
CVE-2024-12387 MEDIUM
binary-husky gpt_academic - Denial of Service via Zip Bomb Upload
CVSS 6.5
CVE-2024-54016 MEDIUM
Apache Seata <2.3.0 - Data Amplification
CVSS 4.3
CVE-2024-54682 MEDIUM
Mattermost 9.5.0-9.5.12 10.1.0-10.1.2 - Denial of Service via Slack Import Zip Bomb
CVSS 6.5
CVE-2024-43499 HIGH
.NET and Visual Studio - Denial of Service via Highly Compressed Data
CVSS 7.5
CVE-2024-1947 MEDIUM
GitLab 13.2.4-16.10.5, 16.11-16.11.2, 17.0 - Denial of Service via Crafted API Calls
CVSS 4.3
CVE-2024-3572 HIGH
Scrapy 2.0.0-2.11.1 - XML External Entity Injection via lxml Parsing
CVSS 7.5
CVE-2024-28101 HIGH
Apollo Router 0.9.5-1.40.2 - Denial of Service via Compressed HTTP Payload Decompression
CVSS 7.5
CVE-2024-28180 MEDIUM
jose <4.0.1-<3.0.3-<2.6.3 - Memory Corruption
CVSS 4.3
CVE-2023-26483 MEDIUM
gosaml2 < 0.9.0 - Denial of Service via Deflate Compression Amplification
CVSS 5.3
CVE-2023-0821 MEDIUM
HashiCorp Nomad <1.3.8-1.4.3 - Info Disclosure
CVSS 6.5
CVE-2023-0475 MEDIUM
HashiCorp go-getter <1.7.0, <2.2.0 - Decompression Bomb
CVSS 4.2
CVE-2022-37439 MEDIUM
Splunk Enterprise and Universal Forwarder 8.1.0-8.1.10 - Denial of Service via Malformed ZIP File
CVSS 5.5
CVE-2022-29225 HIGH
envoyproxy/envoy < 1.22.1 - Denial of Service via Zip Bomb Decompression
CVSS 7.5
CVE-2017-16129 MEDIUM
superagent < 3.7.0 - Denial of Service via ZIP Bomb Response
CVSS 5.9
Details
Vulnerabilities 89