CVE-2022-32206
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially
CVSS
6.5
Medio
EPSS
36.3%
p98
KEV
—
Exploit Today
30
0-100
Publicado: 7 jul 2022 · Última mod.: 14 oct 2026 · CWE-770
33.1%EPSS · 30 días36.3%
2026-10-012026-10-28
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.
- seclists.orghttp://seclists.org/fulldisclosure/2022/Oct/28
- seclists.orghttp://seclists.org/fulldisclosure/2022/Oct/41
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/15/3
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
- hackerone.comhttps://hackerone.com/reports/1570651
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- security.gentoo.orghttps://security.gentoo.org/glsa/202212-01
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20220915-0003/
- support.apple.comhttps://support.apple.com/kb/HT213488
- www.debian.orghttps://www.debian.org/security/2022/dsa-5197
- seclists.orghttp://seclists.org/fulldisclosure/2022/Oct/28
- seclists.orghttp://seclists.org/fulldisclosure/2022/Oct/41
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2023/02/15/3
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
- hackerone.comhttps://hackerone.com/reports/1570651
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/
- security.gentoo.orghttps://security.gentoo.org/glsa/202212-01
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20220915-0003/
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-119209——
———pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive memory while opening a crafted PDF containing cross-reference streams that declare very large entry counts. Highly compressible streams and /Prev chains can multiply the number of parsed entries across a document, while negative /Index counts can bypass the existing per-stream clamp. This issue is fixed in version 6.21.3.6hCVE-2026-909916.5 MED—
———IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.9hCVE-2026-1191346.2 MED—
———Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.6hCVE-2026-1191197.5 ALT—
———Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.11hCVE-2026-1190515.9 MED—
———flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.11hCVE-2026-1186897.5 ALT—
——0OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and accumulate buffered memory, disrupting origin-to-edge stream relay.11h