CWE-409

186 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 0High 100Medium 78Low 5Not scored 3

CVEs per yearBy the year they were published

CVE-2026-65059
Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses
Furl
Not scored
CVE-2026-117677
Gitea Helm chart upload decompression denial of service
Gitea · Gitea
Not scored
CVE-2026-118761
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory
kubeflow · pipelines
High7.5
CVE-2026-118261
Echo: Decompress permits unbounded gzip expansion in v4
labstack · echo
High8.2
CVE-2026-111073
Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
Apache Software Foundation · Apache Kafka
Not scored
CVE-2026-116662
Tanium addressed a compression bomb vulnerability in Enforce.
Tanium · Enforce
High7.5
CVE-2026-116579
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
crossbario · autobahn-python
Medium5.9
CVE-2026-65627
Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
potatosalad · jose
Medium6.9
CVE-2026-93850
Unbounded memory consumption during PDF text extraction
Mattermost · Mattermost
Medium6.5
CVE-2026-97200
Unbounded response body buffering and decompression in hackney
benoitc · hackney
High8.2