By weakness (CWE)

CWE-409: related vulnerabilities

CVEs classified under CWE-409. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

18 published vulnerabilities

• CVE-2026-44697HIGH 8.6

  Klever-Go versions prior to 1.7.17 contain a remote denial-of-service flaw that allows any network participant to crash validator nodes by sending a single, small network message (under 50 KB). The vulnerable code mishandles decompression of batched data, causing the receiving node to allocate multiple gigabytes of memory unexpectedly, leading to out-of-memory crashes. Because validators are critical to blockchain operation, an attacker can disrupt the entire Klever network's ability to process transactions and reach consensus. The attack requires no authentication and can be executed from any peer on the network.

• CVE-2026-10725HIGH 7.5

  Protocol::HTTP2, a Perl library for handling HTTP/2 communication, contains a vulnerability that allows an attacker to consume excessive server memory by sending a specially crafted HTTP/2 request with many headers. The library fails to enforce advertised limits on header sizes, permitting small network payloads to expand dramatically once processed, disrupting server availability. This affects versions before 1.13.

• CVE-2026-24264HIGH 7.5

  NVIDIA Triton Inference Server running on Linux has a vulnerability that allows remote attackers to crash the service by sending specially crafted highly compressed data. An attacker needs no credentials or user interaction to trigger this denial-of-service condition, making it a straightforward attack vector. The vulnerability does not enable data theft or system compromise, but availability impact can be significant for organizations relying on Triton for AI inference workloads.

• CVE-2026-44160HIGH 7.5

  Fluentd versions before 1.19.3 contain a denial-of-service vulnerability in the in_http and in_forward plugins. The plugins accept gzip-compressed data but only limit the size of the *compressed* payload, not the decompressed output. An attacker can send a specially crafted compressed message that expands to an enormous size when decompressed, exhausting the server's memory and causing Fluentd to become unavailable. This affects any Fluentd deployment that receives data from untrusted networks or users.

• CVE-2026-47774HIGH 7.5

  Envoy, a widely-deployed HTTP/2 proxy for cloud applications, contains a memory exhaustion vulnerability that allows attackers to crash the service without authentication. The flaw stems from inadequate header size validation: cookie headers bypass size checks, and compressed header blocks can decompress to enormous sizes that aren't capped. An attacker can exploit this combination to force Envoy to allocate excessive memory, triggering out-of-memory errors and service downtime. Affected versions are older than 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

• CVE-2026-48044HIGH 7.5

  Envoy, a widely-used proxy for containerized environments, contains a flaw in how it handles compressed data. When compression is turned on, an attacker can send a specially crafted compressed payload that tricks Envoy into allocating massive amounts of memory, eventually crashing the proxy with an out-of-memory error. This is a network-accessible denial-of-service vulnerability that requires no authentication.

• CVE-2026-48502HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a critical memory management vulnerability in the timestamp parsing logic. When processing specially crafted MessagePack messages, the library allocates stack memory based on attacker-supplied values without first validating those values are legitimate. This can trigger a stack overflow that crashes the entire application with no opportunity for error handling. An attacker can exploit this remotely with a tiny payload to take down services using vulnerable versions of the library.

• CVE-2026-48510HIGH 7.5

  MessagePack for C# has a denial-of-service vulnerability in how it handles compressed data. When decompressing LZ4-compressed payloads, the library allocates memory based on a size value claimed by the incoming data before checking whether that claim is legitimate. An attacker can send a small malicious file that declares itself to be enormous, forcing the application to reserve huge amounts of memory. This exhausts system resources and crashes the service. The flaw affects versions before 2.5.301 and 3.1.7, and patches are now available.

• CVE-2026-49975HIGH 7.5

  Apache HTTP Server contains a vulnerability in its mod_http module that allows attackers to crash the web server by sending specially crafted HTTP requests. The flaw stems from improper memory allocation handling—specifically, when the server attempts to allocate an excessively large block of memory in response to a malicious request, it can exhaust system resources and cause a denial of service. No user authentication is required to exploit this vulnerability, and attackers can trigger it remotely over the network. Affected versions span from 2.4.17 through 2.4.67.

• CVE-2026-54278HIGH 7.5

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in how it handles compressed request bodies during cleanup operations. An attacker can craft a specially compressed payload that, when processed by vulnerable versions, decompresses into memory as a single large block—potentially overwhelming system resources and causing denial of service. This is a classic 'zip bomb' scenario applied to HTTP request handling. The issue affects AIOHTTP versions before 3.14.1 and requires no authentication or user interaction to exploit.

• CVE-2026-54314HIGH 7.5

  n8n, an open-source workflow automation platform, has a vulnerability in its Compression node that allows an attacker to crash the entire n8n instance by uploading a malicious compressed file. Before version 2.24.0, the decompression feature did not limit how much data it would expand in memory, so a small file can balloon into gigabytes once decompressed, exhausting available RAM and forcing the process to restart. Since this can be triggered through a public webhook without authentication, any organization running a vulnerable n8n instance accessible over the network faces availability risk.

• CVE-2026-59803HIGH 7.5

  rpcx versions through 1.9.3 contain a denial-of-service vulnerability triggered by specially crafted compressed messages. An attacker can send a small gzip-compressed payload that decompresses to gigabytes of data, exhausting server memory and crashing the service. Because this can happen before authentication, no valid credentials are needed—any network-connected attacker can trigger the vulnerability.

• CVE-2026-59939HIGH 7.5

  httplib2, a widely-used Python HTTP client library, contains a flaw that allows attackers to crash applications using it. When an HTTP server returns a response with gzip or deflate compression, httplib2 decompresses the entire payload into memory without checking its final size. An attacker controlling the server (or intercepting traffic) can send a tiny compressed file that expands to gigabytes in memory, overwhelming the client and causing it to run out of memory. This affects all versions before 0.32.0.

• CVE-2026-54233MEDIUM 6.5

  vLLM, an open-source inference engine for large language models, contains a denial-of-service vulnerability in its audio transcription endpoint. The flaw allows an authenticated user to upload a heavily compressed audio file that expands dramatically upon decoding, consuming excessive server memory and crashing the service. A 25 MB compressed OPUS file can balloon to approximately 14.9 GB of uncompressed audio data, overwhelming the system. This affects vLLM versions prior to 0.23.1rc0.

• CVE-2026-55078MEDIUM 6.5

  Coder, a platform for provisioning remote development environments through Terraform, contains a denial-of-service flaw in its file upload API. When authenticated users upload ZIP files, the system decompresses them into memory without enforcing a total size limit—only individual file limits. An attacker with legitimate upload credentials can craft a specially-prepared ZIP to consume all available memory, crashing the service. The flaw affects versions 2.17.0 through 2.34.1; patched versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are now available.

• CVE-2026-61455MEDIUM 6.5

  Grav, a popular flat-file CMS, has a vulnerability in its ZIP file handling that allows authenticated attackers to cause a denial-of-service condition. An attacker with valid credentials can upload or supply a specially crafted ZIP archive that decompresses to an enormous size, filling up the server's available disk space and making the application unavailable. The vulnerability exists because the decompression code does not enforce reasonable limits on how much data can be extracted, how many files can be created, or how deeply files can be nested within the archive.

• CVE-2026-44018MEDIUM 5.5

  Docling, a document processing library that integrates with AI systems, contains a vulnerability in how it handles METS-GBS (a specialized XML-based document archive format) files. Versions 2.45.0 through 2.90.x lack proper security checks when parsing these archives. An attacker could create a malicious METS-GBS file that, when opened by a user in an application using vulnerable Docling, could read files from the system, consume excessive memory or CPU, or crash the application. The vulnerability requires user interaction—the file must be opened—but doesn't require special privileges to trigger.

• CVE-2026-13523LOW 3.3

  GPAC versions up to 26.02.0 contain a flaw in how the ISOBMFF (ISO Base Media File Format) parser handles compressed data during file processing. An attacker with local access to a system running GPAC can craft a malicious media file that triggers excessive data decompression, potentially causing the application to become unavailable or consume excessive system resources. The vulnerability requires direct access to the affected system and local execution context, which significantly limits its real-world attack surface.