#decompression

0 stories this week · 2 this month · 4 in 6 months · mostly security

Stories per day · 30 days

4 stories, newest first · one card per story

Furl versions through 3.15 allow memory exhaustion via unbounded decompression of HTTP responses (CVE-2026-65059).

Only the compressed size is checked against telemetry.max.bytes, default 1 MB, before an unbounded decompress.

Apache MINA CompressionFilter allows unbounded zlib inflation, enabling a decompression-amplification denial of service.

XZ Utils 5.8.4 fixes an invalid memory write that occurs when a decoder is reinitialized after allocation failure in 5.8.3 and older.

Stories tagged #decompression