CWE-409

CVEs per yearBy the year they were published

1. 20181
2. 20222
3. 20233
4. 20246
5. 202517
6. 2026161

Newest CVEs

• CVE-2026-84161

  Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics

  Ericsson · CodeChecker

  Medium4.9
• CVE-2026-119434

  Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

  silviucpp · ezstd

  Medium6.9
• CVE-2026-122323

  Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompression

  kyverno · kyverno

  High8.7
• CVE-2026-122322

  Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompression

  kyverno · kyverno

  High8.7
• CVE-2026-65059

  Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

  Furl

  High7.5
• CVE-2026-117677

  Gitea Helm chart upload decompression denial of service

  Gitea · Gitea

  Not scored
• CVE-2026-118761

  Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

  kubeflow · pipelines

  High7.5
• CVE-2026-118261

  Echo: Decompress permits unbounded gzip expansion in v4

  labstack · echo

  High8.2
• CVE-2026-111073

  Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

  Apache Software Foundation · Apache Kafka

  Medium6.5
• CVE-2026-116662

  Tanium addressed a compression bomb vulnerability in Enforce.

  Tanium · Enforce

  High7.5

Vendors it comes up for most

1. Apache Software Foundation15
2. Mattermost7
3. getgrav5
4. Red Hat4
5. python-pillow4
6. Tanium3
7. envoyproxy3
8. urllib33
9. vllm-project3
10. AsyncHttpClient2