Skip to content
OpenAdvisories

Weakness (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Base Incomplete

The product does not handle or incorrectly
handles a compressed input with a very high compression ratio
that produces a large output.

Source: MITRE CWE-409

All Critical High Medium Low Exploited only Public exploit

203 results · Feed

  • Medium 5.5
    CVE-2022-37439

    Malformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring input

    In Splunk Enterprise and Universal Forwarder versions in the following table, indexing a specially crafted ZIP file using the file monitoring input can result in a crash of the application. Attempts to restart the application would result in a crash and would…

    Splunk Splunk Enterprise Universal Forwarders
  • High 7.5
    CVE-2022-29225

    Zip bomb vulnerability in Envoy

    Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by…

    envoyproxy envoy
  • Medium 5.9
    CVE-2017-16129

    superagent vulnerable to zip bomb attacks

    The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such…

    HackerOne superagent node module node-superagent superagent Debian Ubuntu npm