CWE-409— Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.— MITRE CWE catalog
104 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-409page 3 of 3
- CVE-2026-75936HIGHCVSS 7.5EG 7.52026-08-18
Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily…
- CVE-2026-78206HIGHCVSS 7.5EG 7.52026-08-24
exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in mem…
- CVE-2026-80189MEDIUMCVSS 6.5EG 6.52026-08-25
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end o…
- CVE-2026-8814MEDIUMCVSS 5.3EG 5.32026-05-19
Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When …
Map vulnerabilities like CWE-409 to your infrastructure
EchelonGraph correlates every CVE — across CWE-409 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →