CWEweakness

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific, Python
CWE version
5.0

Description

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Common consequences

• Availability: DoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory) — System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

Observed examples

• CVE-2009-1955: XML bomb in web server module • CVE-2003-1564: Parsing library allows XML bomb

Related

Observed example · CVE (2)

  • CVE-2009-1955 The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn… vulnerability
  • CVE-2003-1564 libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to… vulnerability

Child of · CWE (1)

  • CWE-405 Asymmetric Resource Consumption (Amplification) weakness

Referenced by CVE · weakness (184)

  • CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. vulnerability
  • CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes… vulnerability
  • CVE-2026-118261 Echo is a Go web framework. vulnerability
  • CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. vulnerability
  • CVE-2026-109584 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an… vulnerability
  • CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. vulnerability
  • CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker… vulnerability
  • CVE-2026-93850 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume of text extracted… vulnerability
  • CVE-2026-97200 Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to… vulnerability
  • CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio… vulnerability
  • CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka… vulnerability
  • CVE-2026-113873 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that… vulnerability
  • CVE-2026-115396 Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails… vulnerability
  • CVE-2026-115503 Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that… vulnerability
  • CVE-2026-93471 Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to… vulnerability
  • CVE-2026-114136 Django REST framework is a toolkit for building Web APIs. vulnerability
  • CVE-2026-92823 A flaw was found in libmodulemd. vulnerability
  • CVE-2026-96636 Pillow is a Python imaging library. vulnerability
  • CVE-2026-96637 Pillow is a Python imaging library. vulnerability
  • CVE-2026-90797 An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a… vulnerability
  • CVE-2026-112892 Pillow is a Python imaging library. vulnerability
  • CVE-2026-111924 Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending… vulnerability
  • CVE-2026-102477 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable… vulnerability
  • CVE-2026-102072 An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper Networks Junos OS allows an… vulnerability
  • CVE-2026-102695 OmniFaces is a utility library for Faces. vulnerability
  • CVE-2026-95502 A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly… vulnerability
  • CVE-2026-97334 The network messaging layer contained improper handling of highly compressed data affecting service availability. vulnerability
  • CVE-2026-105274 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or… vulnerability
  • CVE-2026-109226 SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by… vulnerability
  • CVE-2026-109229 SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting… vulnerability
Show all 184 ›

Referenced by CWE · has member (1)