https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:08:40 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-01755 cnvd-2019-01755 https://cve.radiocsirt.org/vuln/cnvd-2019-01755 https://cve.radiocsirt.org/vuln/euvd-2026-169099 EUVD-2026-169099 https://cve.radiocsirt.org/vuln/euvd-2026-169099 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16129 <p>The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.</p> <p>The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-16129 https://cve.radiocsirt.org/vuln/ghsa-8225-6cvr-8pqp <p><strong>Affected:</strong> npm: superagent</p> <p>Affected versions of `superagent` do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a [ZIP bomb](https://en.wikipedia.org/wiki/Zip_bomb) attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed.</p> <p>This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.</p> <p>## Recommendation</p> <p>Update to version 3.7.0 or later.</p> <p><strong>Affected:</strong> npm: superagent</p> <p>Affected versions of `superagent` do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a [ZIP bomb](https://en.wikipedia.org/wiki/Zip_bomb) attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed.</p> <p>This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.</p> <p>## Recommendation</p> <p>Update to version 3.7.0 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-8225-6cvr-8pqp https://cve.radiocsirt.org/vuln/gsd-2017-16129 gsd-2017-16129 https://cve.radiocsirt.org/vuln/gsd-2017-16129 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-16129 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-superagent, Ubuntu:18.04:LTS: node-superagent</p> <p>The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: node-superagent, Ubuntu:18.04:LTS: node-superagent</p> <p>The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-16129