Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-409
Weakness type CWE-409 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 117 | 117 | 0 |
Monthly trend
▁▁▂▁▁▄▆▅█▆
2026-01 2 · 2026-02 0 · 2026-03 4 · 2026-04 2 · 2026-05 2 · 2026-06 13 · 2026-07 21 · 2026-08 18 · 2026-09 32 · 2026-10 23
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-49975 | 7.5 | 90.8 | — | Apache HTTP Server: mod_http2 denial of service |
| CVE-2026-21441 | 8.9 | 86.8 | — | urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects… |
| CVE-2026-75047 | 6.5 | 67.6 | — | — |
| CVE-2026-1526 | 7.5 | 66.9 | — | undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-def… |
| CVE-2026-48586 | 8.7 | 63.1 | — | Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrif… |
| CVE-2026-41608 | 7.5 | 63.1 | — | Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport |
| CVE-2026-49158 | 7.5 | 63.1 | — | Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb |
| CVE-2026-29785 | 7.5 | 61.4 | — | NATS Server panic via malicious compression on leafnode port |
| CVE-2026-15709 | 7.5 | 58.5 | — | Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded… |
| CVE-2026-44432 | 8.9 | 58.4 | — | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API |
| CVE-2026-69304 | 5.9 | 58.2 | — | ASP.NET Core Denial of Service Vulnerability |
| CVE-2026-40192 | 8.7 | 58.0 | — | Pillow is vulnerable to a FITS GZIP decompression bomb |
| CVE-2026-2575 | 5.3 | 57.9 | — | Keycloak: keycloak: denial of service due to excessive samlrequest decompression |
| CVE-2026-46387 | 7.5 | 57.6 | — | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-89059 | 7.5 | 57.3 | — | Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) |
| CVE-2026-40036 | 8.7 | 55.4 | — | Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression |
| CVE-2026-82520 | 8.7 | 55.2 | — | parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments |
| CVE-2026-59803 | 8.7 | 53.8 | — | rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol |
| CVE-2026-83599 | 7.5 | 53.8 | — | Netdata: WebSocket Decompression Bomb |
| CVE-2026-68981 | 8.8 | 53.7 | — | Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 12 |
| getgrav | 5 |
| mattermost | 4 |
| red hat | 3 |
| aio-libs | 2 |
| asynchttpclient | 2 |
| docling-project | 2 |
| eclipse foundation | 2 |
| elastic | 2 |
| erlang | 2 |
| fluent | 2 |
| hexpm | 2 |
| messagepack-csharp | 2 |
| oisf | 2 |
| sgl-project | 2 |
