CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
89 vulnerabilities with CWE-409
CVE-2024-12387
MEDIUM
binary-husky gpt_academic - Denial of Service via Zip Bomb Upload
CVSS 6.5
CVE-2024-54016
MEDIUM
Apache Seata <2.3.0 - Data Amplification
CVSS 4.3
CVE-2024-54682
MEDIUM
Mattermost 9.5.0-9.5.12 10.1.0-10.1.2 - Denial of Service via Slack Import Zip Bomb
CVSS 6.5
CVE-2024-43499
HIGH
.NET and Visual Studio - Denial of Service via Highly Compressed Data
CVSS 7.5
CVE-2024-1947
MEDIUM
GitLab 13.2.4-16.10.5, 16.11-16.11.2, 17.0 - Denial of Service via Crafted API Calls
CVSS 4.3
CVE-2024-3572
HIGH
Scrapy 2.0.0-2.11.1 - XML External Entity Injection via lxml Parsing
CVSS 7.5
CVE-2024-28101
HIGH
Apollo Router 0.9.5-1.40.2 - Denial of Service via Compressed HTTP Payload Decompression
CVSS 7.5
CVE-2024-28180
MEDIUM
jose <4.0.1-<3.0.3-<2.6.3 - Memory Corruption
CVSS 4.3
CVE-2023-26483
MEDIUM
gosaml2 < 0.9.0 - Denial of Service via Deflate Compression Amplification
CVSS 5.3
CVE-2023-0821
MEDIUM
HashiCorp Nomad <1.3.8-1.4.3 - Info Disclosure
CVSS 6.5
CVE-2023-0475
MEDIUM
HashiCorp go-getter <1.7.0, <2.2.0 - Decompression Bomb
CVSS 4.2
CVE-2022-37439
MEDIUM
Splunk Enterprise and Universal Forwarder 8.1.0-8.1.10 - Denial of Service via Malformed ZIP File
CVSS 5.5
CVE-2022-29225
HIGH
envoyproxy/envoy < 1.22.1 - Denial of Service via Zip Bomb Decompression
CVSS 7.5
CVE-2017-16129
MEDIUM
superagent < 3.7.0 - Denial of Service via ZIP Bomb Response
CVSS 5.9
Details
Vulnerabilities
89