Weakness (CWE)
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly
handles a compressed input with a very high compression ratio
that produces a large output.
Source: MITRE CWE-409
6 results · Clear filters · Feed
-
Low 2.1
hex_core decompresses registry and Erlang term API responses without size limits
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is ve…
-
Low 2.1
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetc…
-
Low 2.7
fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`
fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with…
-
Low 3.1
Tanium addressed a compression bomb vulnerability in Findings.
Tanium addressed a compression bomb vulnerability in Findings.
-
Low 3.1
Tanium addressed a compression bomb vulnerability in Threat Response.
Tanium addressed a compression bomb vulnerability in Threat Response.
-
Low 3.3
GPAC ISOBMFF base_encoding.c data amplification
A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The…