https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T08:16:26.874408+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/certfr-2026-avi-1385 certfr-2026-avi-1385 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-29T08:16:26.880195+00:00 certfr-2026-avi-1385 https://db.gcve.eu/vuln/cleanstart-2026-ex41595 CLEANSTART-2026-EX41595 — CompressionUtils 2026-10-29T08:16:26.880247+00:00

Affected: CleanStart: wildfly

Security vulnerability affects the wildfly package. CompressionUtils.

 https://db.gcve.eu/vuln/fkie_cve-2026-78384 fkie_cve-2026-78384 2026-10-29T08:16:26.880285+00:00

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation.

Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.

 https://db.gcve.eu/vuln/ghsa-m259-q69p-995q GHSA-m259-q69p-995q 2026-10-29T08:16:26.880325+00:00

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation.

Fix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.