Cyber Resilience

CWE · MITRE source

CWE-409Improper Handling of Highly Compressed Data (Data Amplification)

Abstraction: Base · CVEs in our corpus: 101

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

Last updated: 22 August 2026 07:11 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • SC-5 Denial-of-service Protection
  • PR.IR-04
  • PR.PS-06
  • SC-6 Resource Availability
Detect
Catch it (CSF Detect / Respond)
  • DE.CM-09
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control Title Family Why it addresses this CWE
SC-5Denial-of-service ProtectionSCLimits effects of data amplification from compressed or malicious inputs.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2026-49975 7.37.50.27982026-06-08
CVE-2026-278096.89.10.00412026-02-26
CVE-2024-43499 6.37.50.02602024-11-12
CVE-2026-21441 6.37.50.02712026-01-07
CVE-2026-44697 6.28.60.00382026-05-29
CVE-2022-29225 6.17.50.01542022-06-09
CVE-2026-1526 6.17.50.01152026-03-12
CVE-2026-416086.17.50.01102026-07-27
CVE-2026-485866.17.50.01072026-07-27
CVE-2026-491586.17.50.01102026-07-27
CVE-2024-28101 6.07.50.00772024-03-21
CVE-2024-3572 6.07.50.00812024-04-16
CVE-2024-12886 6.07.50.00712025-03-20
CVE-2024-7765 6.07.50.00752025-03-20
CVE-2026-47774 6.07.50.00972026-06-17
CVE-2025-30153 5.97.50.00522025-03-19
CVE-2025-58057 5.97.50.00602025-09-04
CVE-2025-664715.97.50.00692025-12-05
CVE-2025-66909 5.97.50.00532025-12-19
CVE-2025-69223 5.97.50.00502026-01-05
CVE-2026-29785 5.97.50.00662026-03-25
CVE-2026-40036 5.97.50.00512026-04-08
CVE-2026-40192 5.97.50.00672026-04-15
CVE-2026-44432 5.97.50.00682026-05-13
CVE-2026-49755 5.97.50.00602026-06-08