Skip to content
Log inStart free trial

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Base

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

Consequences

  • Availability: DoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

Recent advisories

  • EEF-CVE-2026-65627 — Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
  • EEF-CVE-2026-97200 — Unbounded response body buffering and decompression in hackney
  • EEF-CVE-2026-109584 — HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
  • EEF-CVE-2026-93471 — Unbounded SAML message decompression in esaml allows memory exhaustion
  • GHSA-g842-9rc4-69pw — Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
  • GHSA-p8hx-v2p6-rp84 — Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
  • GHSA-gg2r-wvfm-q9rx — Pillow: MSP RLE decoder expands a tiny file into unbounded memory
  • EEF-CVE-2026-105274 — hex_core decompresses registry and Erlang term API responses without size limits
  • GHSA-x8v2-478q-2hvg — AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
  • GHSA-mcm9-63f2-9j32 — devalue: Repeated primitive strings cause quadratic expansion in uneval
  • GHSA-7grg-jcf7-rpmx — AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
  • GHSA-w7jp-mf2v-8342 — Vikunja: Denial of service via decompression bomb in the data import
  • GHSA-8xx6-hgc6-gc2m — HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
  • GHSA-2mrg-gjxq-2gvr — PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
  • GHSA-6hm7-3pwj-22rm — Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

All advisories for CWE-409

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor