Base weakness
Incomplete
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
43
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
Real-world CVEs
43 recorded CVEs are caused by CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification)). The highest-severity and most recent are shown first. 18 new CWE-409 CVEs have been recorded so far in 2026 (14 in 2025).