CWE-409— Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.— MITRE CWE catalog
202 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-409page 5 of 5
- CVE-2026-96618LOWCVSS 2.1EG 2.12026-10-12
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch …
- CVE-2026-28975MEDIUMEG not assessed2026-06-12
NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length ### Impact When `NIOHTTPRequestDecompressor` is configured with `.ratio(N)`, the decompression limit is enforced using the `Content-Length` header value…
Map vulnerabilities like CWE-409 to your infrastructure
EchelonGraph correlates every CVE — across CWE-409 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →