Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

82 advisories

Loading
Echo: Decompress permits unbounded gzip expansion in v4 High
GHSA-h7wr-284f-5qvc was published for github.com/labstack/echo/v4 (Go) Oct 23, 2026
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated... High Unreviewed
CVE-2026-113873 was published Oct 22, 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS High
CVE-2026-96637 was published for pillow (pip) Oct 22, 2026
sonicnew Credited to sonicnew, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox... High Unreviewed
CVE-2026-93471 was published Oct 22, 2026
Pillow: MSP RLE decoder expands a tiny file into unbounded memory High
CVE-2026-112892 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all... High Unreviewed
CVE-2026-90797 was published Oct 20, 2026
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated... High Unreviewed
CVE-2026-111924 was published Oct 17, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-102477 was published Oct 15, 2026
An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd... High Unreviewed
CVE-2026-102072 was published Oct 14, 2026
The network messaging layer contained improper handling of highly compressed data affecting... High Unreviewed
CVE-2026-97334 was published Oct 13, 2026
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media... High Unreviewed
CVE-2026-109324 was published Oct 12, 2026
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the... High Unreviewed
CVE-2026-109398 was published Oct 12, 2026
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow... High Unreviewed
CVE-2026-109229 was published Oct 12, 2026
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that... High Unreviewed
CVE-2026-109226 was published Oct 12, 2026
Vikunja: Denial of service via decompression bomb in the data import High
CVE-2026-91979 was published for code.vikunja.io/api (Go) Oct 9, 2026
Str1ckl4nd Credited to Str1ckl4nd, 7thParkk, 0xcelien, and JellowBeanz26 7thParkk 7thParkk
0xcelien 0xcelien JellowBeanz26 JellowBeanz26
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap.... High Unreviewed
CVE-2026-78384 was published Oct 9, 2026
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled High
CVE-2026-107227 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Praxis affected by HTTP/2 Bomb High
GHSA-cjcg-cxmh-9wcr was published for praxis-proxy (Rust) Oct 2, 2026
Improper handling of highly compressed data (data amplification), Function call with incorrectly... High Unreviewed
CVE-2026-94636 was published Oct 2, 2026
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift... High Unreviewed
CVE-2026-94637 was published Oct 2, 2026
devalue: Repeated primitive strings cause quadratic expansion in uneval High
GHSA-mcm9-63f2-9j32 was published for devalue (npm) Oct 1, 2026
elliott-with-the-longest-name-on-github Credited to elliott-with-the-longest-name-on-github
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in... High Unreviewed
CVE-2026-103262 was published Oct 1, 2026
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM High
GHSA-chx6-46f5-w4vp was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and aoto-tech aoto-tech aoto-tech
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 High
GHSA-rcw4-f5rp-g42v was published for adm-zip (npm) Sep 29, 2026
dilipk5 Credited to dilipk5
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database