CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
Apache CXF can expand a small attacker DEFLATE payload into gigabytes, causing a decompression-bomb denial of service.
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #decompression-bomb
usvg SVGZ decompression bomb in `Tree::from_data`
usvg automatically decompresses SVGZ in Tree::from_data, enabling a gzip decompression-bomb denial of service.