CVE-2026-59803

The record

rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.

Affected packages

Related vulnerabilities

• CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… CWE-409
• CVE-2026-118261 Echo is a Go web framework. CWE-409
• CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a… CWE-409
• CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. CWE-409
• CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted… CWE-409
• CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in… CWE-409
• CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the… CWE-409
• CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results… CWE-409