https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 23:16:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-224134 EUVD-2026-224134 https://cve.radiocsirt.org/vuln/euvd-2026-224134 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30160 <p>Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0.</p> <p>Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability is fixed in 0.36.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-30160 https://cve.radiocsirt.org/vuln/ghsa-g8vq-v3mg-7mrg <p><strong>Affected:</strong> crates.io: redlib</p> <p>A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability was introduced in 2e95e1fc6e2064ccfae87964b4860bda55eddb9a and fixed in 15147cea8e42f6569a11603d661d71122f6a02dc.</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>This vulnerability allows a remote attacker with network access to exploit the preference restoration mechanism by providing a compressed payload that expands dramatically upon decompression. The issue arises because the system automatically decompresses user-supplied data without enforcing size limits, potentially leading to:</p> <p>- Out-of-memory (OOM) conditions - OS-level resource exhaustion, potentially leading to broader system instability or crashes - Repeated exploitation, keeping the target system in a persistent degraded state - Denial-of-service of any public instance</p> <p>### Patches The problem has been patched in 15147cea8e42f6569a11603d661d71122f6a02dc. Users should upgrade to v0.36.0.</p> <p>### Workarounds Until a patch is available, users can:</p> <p>- Implement request size limits at the web server or application level to reject excessively large inputs. - Disable or restrict the restore_preferences route (`/settings/encoded-restore`) at…</p> <p><strong>Affected:</strong> crates.io: redlib</p> <p>A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condition by submitting a specially crafted base2048-encoded DEFLATE decompression bomb to the restore_preferences form. This leads to excessive memory consumption and potential system instability, which can be exploited to disrupt Redlib instances. This vulnerability was introduced in 2e95e1fc6e2064ccfae87964b4860bda55eddb9a and fixed in 15147cea8e42f6569a11603d661d71122f6a02dc.</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_</p> <p>This vulnerability allows a remote attacker with network access to exploit the preference restoration mechanism by providing a compressed payload that expands dramatically upon decompression. The issue arises because the system automatically decompresses user-supplied data without enforcing size limits, potentially leading to:</p> <p>- Out-of-memory (OOM) conditions - OS-level resource exhaustion, potentially leading to broader system instability or crashes - Repeated exploitation, keeping the target system in a persistent degraded state - Denial-of-service of any public instance</p> <p>### Patches The problem has been patched in 15147cea8e42f6569a11603d661d71122f6a02dc. Users should upgrade to v0.36.0.</p> <p>### Workarounds Until a patch is available, users can:</p> <p>- Implement request size limits at the web server or application level to reject excessively large inputs. - Disable or restrict the restore_preferences route (`/settings/encoded-restore`) at…</p> https://cve.radiocsirt.org/vuln/ghsa-g8vq-v3mg-7mrg