Improper Handling of Highly Compressed Data (Data Amplification)
CWE-409
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
We track 98 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7.
Latest Improper Handling of Highly Compressed Data (Data Amplification) vulnerabilities
- 8.2 High severity
grpc: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang external term in a gRPC message body. GRPC.Codec.Erlpack.decode/2
- 7.5 High severity
actix-http: Improper Handling of Highly Compressed Data (Data Amplification)
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli
- 7.5 High severity
kyverno: Improper Handling of Highly Compressed Data (Data Amplification)
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in FetchSignatureBlob that allows attackers to exhaust memory by supplying highly compressed notary signature layers. Attackers who control registry referrers or signatures can
- 7.5 High severity
kyverno: Improper Handling of Highly Compressed Data (Data Amplification)
Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in extractStatement that allows remote attackers to exhaust memory by supplying highly compressed attestation layers. Attackers controlling registry referrer artifacts can push
- 7.5 High severity
pipelines: Improper Handling of Highly Compressed Data (Data Amplification)
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A
- 8.2 High severity
echo: Uncontrolled Resource Consumption
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it,
- 8.2 High severity
hackney: Improper Handling of Highly Compressed Data (Data Amplification)
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the w
- 8.7 High severity
bandit: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one la
- 7.5 High severity
HAPI FHIR: Improper Handling of Highly Compressed Data (Data Amplification)
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
- 8.7 High severity
esaml: Improper Handling of Highly Compressed Data (Data Amplification)
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse. esaml_binding:decode_response/2 base64
- 7.5 High severity
django-rest-framework: Improper Handling of Highly Compressed Data (Data Amplification)
Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec ra
- 7.7 High severity
Apache CouchDB: Improper Handling of Highly Compressed Data (Data Amplification)
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
- 7.5 High severity
Pillow: Improper Handling of Highly Compressed Data (Data Amplification)
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker
- 7.5 High severity
fleet: Improper Handling of Highly Compressed Data (Data Amplification)
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthe
- 8.2 High severity
omnifaces: Insufficient Verification of Data Authenticity
OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it
- 8.7 High severity
Commvault Cloud: Improper Handling of Highly Compressed Data (Data Amplification)
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Ce
- 7.5 High severity
php-image-resize: Improper Handling of Highly Compressed Data (Data Amplification)
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed
- 7.5 High severity
sglang: Improper Handling of Highly Compressed Data (Data Amplification)
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed ima
- 7.5 High severity
sglang: Improper Handling of Highly Compressed Data (Data Amplification)
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded sil
- 7.5 High severity
Apache CXF: Improper Handling of Highly Compressed Data (Data Amplification)
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wr
- 7.5 High severity
async-http-client: Uncontrolled Resource Consumption
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipe
- 8.2 High severity
Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
- 8.2 High severity
Apache Thrift: Improper Handling of Highly Compressed Data (Data Amplification)
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0
- 7.5 High severity
tornado: Improper Handling of Highly Compressed Data (Data Amplification)
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accu
- 7.5 High severity
Fireware OS: Uncontrolled Resource Consumption
An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.
- 8.7 High severity
nicotine-plus: Improper Handling of Highly Compressed Data (Data Amplification)
Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. Th
- 7.5 High severity
rabbitmq-server: Improper Handling of Highly Compressed Data (Data Amplification)
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size,
- 7.5 High severity
netdata: Improper Handling of Highly Compressed Data (Data Amplification)
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow de
- 8.7 High severity
vector: Improper Handling of Highly Compressed Data (Data Amplification)
Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0
- 7.5 High severity
Apache MINA: Improper Handling of Highly Compressed Data (Data Amplification)
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater t
- 7.5 High severity
suricata: Uncontrolled Resource Consumption
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs
- 7.5 High severity
libheif: Improper Handling of Highly Compressed Data (Data Amplification)
libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHand
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.4.redhat: Improper Handling of Highly Compressed Data (Data Amplification)
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enorm
- 7.5 High severity
async-http-client: Uncontrolled Resource Consumption
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDe
- 7.5 High severity
Apache NiFi: Improper Handling of Highly Compressed Data (Data Amplification)
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances
- 7.5 High severity
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare…
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Healt
- 7.5 High severity
adm-zip: Improper Handling of Highly Compressed Data (Data Amplification)
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause de
- 7.5 High severity
http4k: Improper Handling of Highly Compressed Data (Data Amplification)
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthentic
- 7.5 High severity
suricata: Improper Handling of Highly Compressed Data (Data Amplification)
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective
- 7.3 High severity
Secure Connect Gateway 5.0 - Application: Improper Handling of Highly Compressed Data (Data Amplification)
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability. An unauthenticated attacker with remote access could pote