CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)
Monthly
Unauthenticated remote attackers can exhaust server memory in Eclipse Vert.x deployments that expose the io.vertx:vertx-grpc-server component by sending small, highly compressed gRPC messages whose decompressed payload greatly exceeds the configured per-message maximum size, producing an availability-only denial-of-service condition. The affected ranges are Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the flaw is only reachable when a gRPC endpoint is network-reachable and accepts client-supplied message compression (standard gRPC gzip/deflate negotiation). The source reports a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H with no confidentiality or integrity impact); our independent CVSS 3.1 assessment agrees it is availability-only (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and there is no public exploit code and no CISA KEV listing identified at time of analysis - the practical precondition is simply that the per-message size limit is being relied upon as the sole defense, since that limit is enforced against compressed bytes only.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
Unauthenticated remote attackers can exhaust resources and disrupt availability across Commvault Cloud deployments by sending specially crafted, highly compressed messages to the platform's network messaging layer. Affected components include the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes, meaning any deployment exposing the messaging service on the network is reachable under default configurations (PR:N, UI:N). Impact is confined to availability (service disruption/denial of service) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS data was not provided. Commvault has resolved the issue in a maintenance release and directs all customers to upgrade.
Memory exhaustion denial of service affects Grav CMS versions before 2.1.7, where an authenticated user with media-author upload privileges can submit a highly compressed oversized raster image that, when referenced through a Twig or Markdown image transform, is fully decoded by GD or Imagick without source-dimension validation. Once the transformed image is embedded in published content, unauthenticated page requests repeatedly trigger the decode-and-allocate behavior, causing sustained page unavailability; the assessed CVSS 4.0 base score is 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H), and no public exploit code was identified at time of analysis.
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.
Memory-exhaustion denial of service in SGLang (all versions through 0.5.21) allows remote, unauthenticated attackers to crash inference workers by submitting small, highly compressed images with enormous pixel dimensions to the image loader. The root cause is that NanoNemotronVLImageProcessor sets Pillow's Image.MAX_IMAGE_PIXELS to None, a process-wide global that disables decompression-bomb protection for the entire worker, including the generic image-loading path used by other models. Per the independent assessment this is a genuine but bounded availability risk: it only affects deployments that actually load NanoNemotronVLImageProcessor, and there is no public exploit identified at time of analysis. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
Denial of service in SGLang through 0.5.21: unauthenticated remote attackers can exhaust server memory and CPU by submitting tiny, highly compressed FLAC files (typically pure digital silence) through the audio_url or audio_data inputs of the multimodal audio pipeline, which decodes them into enormous PCM buffers with no duration or sample-count ceiling. The issue is scored 8.7 under CVSS 4.0 (and AV:N/AC:L/PR:N/UI:N/A:H under CVSS 3.1) with availability impact only and no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Exposure is bounded: only deployments that actually serve an audio-capable multimodal model and accept attacker-supplied audio without authentication, request limits, or resource caps can be driven into memory exhaustion, making this a genuine but configuration-dependent availability risk.
A remote, unauthenticated attacker can exhaust server heap memory in Apache CXF by submitting a small (kilobyte-scale) DEFLATE payload that inflates to gigabytes when the framework decompresses it without any output-size cap. The flaw is reachable through two deployment-specific paths: JWE decryption when the 'zip=DEF' compression header is present (for example a JoseSessionTokenProvider configured with RSA-OAEP key wrap), and SAML token inflation over the HTTP redirect or POST binding - in both cases decompression occurs before or independently of any trust, signature, or key validation, so no credentials or valid keys are needed. Impact is availability only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), with confirmed exploitation limited to reachable configurations; EPSS is 0.16% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable 10 MiB inflation cap.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.
Unauthenticated remote attackers can exhaust server memory in Eclipse Vert.x deployments that expose the io.vertx:vertx-grpc-server component by sending small, highly compressed gRPC messages whose decompressed payload greatly exceeds the configured per-message maximum size, producing an availability-only denial-of-service condition. The affected ranges are Vert.x 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, and the flaw is only reachable when a gRPC endpoint is network-reachable and accepts client-supplied message compression (standard gRPC gzip/deflate negotiation). The source reports a CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H with no confidentiality or integrity impact); our independent CVSS 3.1 assessment agrees it is availability-only (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and there is no public exploit code and no CISA KEV listing identified at time of analysis - the practical precondition is simply that the per-message size limit is being relied upon as the sole defense, since that limit is enforced against compressed bytes only.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
Unauthenticated remote attackers can exhaust resources and disrupt availability across Commvault Cloud deployments by sending specially crafted, highly compressed messages to the platform's network messaging layer. Affected components include the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes, meaning any deployment exposing the messaging service on the network is reachable under default configurations (PR:N, UI:N). Impact is confined to availability (service disruption/denial of service) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS data was not provided. Commvault has resolved the issue in a maintenance release and directs all customers to upgrade.
Memory exhaustion denial of service affects Grav CMS versions before 2.1.7, where an authenticated user with media-author upload privileges can submit a highly compressed oversized raster image that, when referenced through a Twig or Markdown image transform, is fully decoded by GD or Imagick without source-dimension validation. Once the transformed image is embedded in published content, unauthenticated page requests repeatedly trigger the decode-and-allocate behavior, causing sustained page unavailability; the assessed CVSS 4.0 base score is 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H), and no public exploit code was identified at time of analysis.
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.
Memory-exhaustion denial of service in SGLang (all versions through 0.5.21) allows remote, unauthenticated attackers to crash inference workers by submitting small, highly compressed images with enormous pixel dimensions to the image loader. The root cause is that NanoNemotronVLImageProcessor sets Pillow's Image.MAX_IMAGE_PIXELS to None, a process-wide global that disables decompression-bomb protection for the entire worker, including the generic image-loading path used by other models. Per the independent assessment this is a genuine but bounded availability risk: it only affects deployments that actually load NanoNemotronVLImageProcessor, and there is no public exploit identified at time of analysis. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
Denial of service in SGLang through 0.5.21: unauthenticated remote attackers can exhaust server memory and CPU by submitting tiny, highly compressed FLAC files (typically pure digital silence) through the audio_url or audio_data inputs of the multimodal audio pipeline, which decodes them into enormous PCM buffers with no duration or sample-count ceiling. The issue is scored 8.7 under CVSS 4.0 (and AV:N/AC:L/PR:N/UI:N/A:H under CVSS 3.1) with availability impact only and no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Exposure is bounded: only deployments that actually serve an audio-capable multimodal model and accept attacker-supplied audio without authentication, request limits, or resource caps can be driven into memory exhaustion, making this a genuine but configuration-dependent availability risk.
A remote, unauthenticated attacker can exhaust server heap memory in Apache CXF by submitting a small (kilobyte-scale) DEFLATE payload that inflates to gigabytes when the framework decompresses it without any output-size cap. The flaw is reachable through two deployment-specific paths: JWE decryption when the 'zip=DEF' compression header is present (for example a JoseSessionTokenProvider configured with RSA-OAEP key wrap), and SAML token inflation over the HTTP redirect or POST binding - in both cases decompression occurs before or independently of any trust, signature, or key validation, so no credentials or valid keys are needed. Impact is availability only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), with confirmed exploitation limited to reachable configurations; EPSS is 0.16% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable 10 MiB inflation cap.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.