Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1023

Esta semana

RSS

Vulnerabilidades × cwe-409 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-107227] The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async…

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSiz…

M Alto vulnerabilidad

Vulnerabilidad alta de acumulación de memoria en Tornado anterior a 6.5.9

Tornado versions anteriores a 6.5.9 contienen una vulnerabilidad de acumulación ilimitada de memoria en CurlAsyncHTTPClient que permite a atacantes remotos causar denegación de servicio. Los atacantes pueden enviar bombas de descompresión gzip que se acumulan sin límites en memoria, provocando que el proceso de la aplicación sea terminado por condiciones de falta de memoria. Esto afecta directamente a aplicaciones web y APIs en producción que procesan respuestas comprimidas sin validación de tamaño.

M Alto vulnerabilidad

[CVE-2026-83599] Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket s…

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can t…

M Alto vulnerabilidad

CVE-2026-47321: Desbordamiento de memoria en CompressionFilter por inflado descontrolado de datos

La clase CompressionFilter utiliza ZLib para comprimir y descomprimir datos en tránsito. Una falla en el control del tamaño resultante durante la descompresión permite que datos maliciosos con ratios de compresión superiores a 1000:1 agoten la memoria del servidor, causando denegación de servicio. Afecta aplicaciones de procesamiento de datos en infraestructuras altas, financieras y de telecomunicaciones en LATAM.

M Alto vulnerabilidad

[CVE-2026-63452] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in …

M Alto vulnerabilidad

[CVE-2026-84384] libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF o…

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data can cause decompress_brotli() and do_inflate() to grow accumulated output without an effective size limit or MemoryHandle accounting. The brotli path has no output bound, while the zlib path checks only a small temporary buffer in a branch that valid streams …

M Alto vulnerabilidad

[CVE-2026-89059] A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodie…

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-85721] The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async…

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who…

M Alto vulnerabilidad

[CVE-2026-81875] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose small raw-DEFLATE payload expands to a very large value. SHCParser.decodeJWT()…

M Alto vulnerabilidad

[CVE-2026-92000] adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entrie…

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

M Alto vulnerabilidad

[CVE-2026-53659] http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0…

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap and denying service to other clien…

M Alto vulnerabilidad

[CVE-2026-46387] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Su…

M Alto vulnerabilidad

Vulnerabilidad alta en Dell SCG 5.0 permite ataque de denegación de servicio

Dell SCG 5.0 Appliance (versiones anteriores a 5.36.00.16) y Dell SCG 5.0 Application (anteriores a 5.36.00.00) contienen una vulnerabilidad de manejo impropio de datos comprimidos que permite amplificación de datos. Atacantes no autenticados con acceso remoto pueden explotar esta falla para causar denegación de servicio en infraestructuras de storage y gestión de contenido de empresas en México y Latinoamérica.

M Alto vulnerabilidad

[CVE-2026-85786] Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote atta…

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.

M Alto vulnerabilidad

[CVE-2026-82520] parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no li…

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memo…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

Vulnerabilidad de desbordamiento de memoria en HTTPX2 anterior a versión 2.12.0 (CVE-2026-84382)

HTTPX2, cliente HTTP de nueva generación para Python, contiene una vulnerabilidad en sus decodificadores de contenido (gzip, deflate, br, zstd) que permite ataques de denegación de servicio. Fragmentos comprimidos de 64 KiB pueden expandirse hasta 64 MiB en memoria, causando consumo excesivo de recursos en servidores y aplicaciones Python. Afecta principalmente a infraestructuras que procesan contenido comprimido desde orígenes no confiables.

M Alto vulnerabilidad

[CVE-2026-78206] exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory witho…

exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

M Alto vulnerabilidad

[CVE-2026-75936] Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-jav…

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set a…

M Alto vulnerabilidad

[CVE-2026-73232] ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to ca…

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently decompressed, or chunked response bodies without a decompressed-size bound. This issue is fixed in vers…

M Alto vulnerabilidad

[CVE-2026-59932] PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th…

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without…

1 2 Siguiente →