CWE-409 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-409 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
CVE-2026-89059A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodie…0.8%높음7.5CVE-2026-69304Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthori…0.8%보통5.9CVE-2026-83599Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket s…0.7%높음7.5CVE-2026-90797An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms…0.7%높음7.7CVE-2026-109584Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 impleme…0.6%높음8.7CVE-2026-81875HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…0.6%높음7.5CVE-2026-63452Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…0.6%높음7.5CVE-2026-84384libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF o…0.6%높음7.5
전체 목록
74건
CVE-2026-97200Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a…0.6%높음8.2
CVE-2026-113873SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to se…0.5%높음8.7
CVE-2026-70469Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected r…0.5%높음7.5
CVE-2026-103262Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient th…0.5%높음8.7
CVE-2026-118761Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2…0.5%높음7.5
CVE-2026-46387Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring …0.5%높음7.5
CVE-2026-77620Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source feeds …0.5%높음8.7
CVE-2026-77528Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to …0.5%보통5.3
CVE-2026-47321The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming …0.5%높음7.5
CVE-2026-109226SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote at…0.5%높음8.7
CVE-2026-114136Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_fr…0.4%높음7.5
CVE-2026-93471Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an u…0.4%높음8.7
CVE-2026-109398Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constr…0.5%높음8.7
CVE-2026-53659http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, Server…0.4%높음7.5
CVE-2026-96637Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py re…0.4%높음7.1
CVE-2026-116579Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7…0.4%보통5.9
CVE-2026-82520parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on dec…0.4%높음8.7
CVE-2026-107227The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously …0.4%높음7.5
CVE-2026-66054Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplif…0.4%보통6.9
CVE-2026-94636Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arg…0.4%높음8.2
CVE-2026-94637Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. T…0.4%높음8.2
CVE-2026-109229SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb prote…0.4%높음8.7
CVE-2026-105274Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an unt…0.4%낮음2.1
CVE-2026-102072An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd of Juniper N…0.4%높음7.1
CVE-2026-92000adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare …0.4%높음8.7
CVE-2026-93850Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the…0.4%보통6.5
CVE-2026-118261Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-dec…0.4%높음8.2
CVE-2026-77021Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 an…0.4%보통5.3
CVE-2026-95502A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by retur…0.4%보통5.3
CVE-2026-107335Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-…0.4%보통6.5
CVE-2026-44162fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plu…0.4%낮음2.7
CVE-2026-85721The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously …0.4%높음7.5
CVE-2026-96636Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later…0.4%보통6.5
CVE-2026-111924Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaus…0.4%높음8.7
CVE-2026-67232RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The…0.4%높음8.2
CVE-2026-97334The network messaging layer contained improper handling of highly compressed data affecting service availabili…0.4%높음8.7
CVE-2026-86104An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote,…0.4%높음8.7
CVE-2026-44163fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. P…0.3%보통5.3
CVE-2026-85786Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to c…0.3%높음8.7
CVE-2026-96618Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untruste…0.3%낮음2.1
CVE-2026-102477In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoi…0.3%높음8.7
CVE-2026-116175vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal…0.3%높음7.1
CVE-2026-109324Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaus…0.3%높음7.1
CVE-2026-107210ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-…0.3%보통5.3
CVE-2026-102695OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.…0.3%높음8.2
CVE-2026-68911Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified rem…0.3%높음8.7
CVE-2026-112892Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file …0.3%높음8.7
CVE-2026-65827Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authentica…0.3%보통6.5
CVE-2026-90555vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing…0.3%높음7.1
CVE-2026-92573Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10…0.3%보통6.5
CVE-2026-89321Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but noth…0.3%보통4.3
CVE-2026-108750OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to…0.3%보통5.3
CVE-2026-65627Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jos…0.2%보통6.9
CVE-2026-5132Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit si…0.2%보통6.5
CVE-2026-15814Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit th…0.2%보통6.5
CVE-2026-65059Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Fur…0.2%미평가
CVE-2026-105747Docling simplifies document processing by parsing diverse formats and providing integrations with the generati…0.2%보통4.3
CVE-2026-115638OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amou…0.2%보통4.3
CVE-2026-117677When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for…0.2%미평가
CVE-2026-111073The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload a…0.2%미평가
CVE-2026-79695Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.2%높음7.3
CVE-2026-106585In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded du…0.2%보통6.5
CVE-2026-92823A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompresse…0.2%보통6.2
CVE-2026-115503Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unz…0.1%보통6.8
CVE-2026-115396Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.p…0.1%보통6.8
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.