CVE-2026-11617

Awaiting Analysis Awaiting Analysis - Queue

Compression Bomb Vulnerability in Tanium Findings

Publication date: 2026-08-19

Last updated on: 2026-09-01

Assigner: Tanium

Description

Tanium addressed a compression bomb vulnerability in Findings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-09-01

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-11617

Affected Vendors & Products

Vendor	Product	Version / Range
tanium	findings	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This is a compression bomb vulnerability in Tanium Findings. It involves malicious data that can cause excessive resource consumption when decompressed, potentially leading to denial of service conditions.

Detection Guidance

To detect this vulnerability, check the version of Tanium Findings installed on your system. Compare it against the affected versions: prior to Update MR22 (v1.2.95) for 2025H1, prior to Update MR12 (v1.2.95) for 2025H2, or prior to Update MR4 (v1.4.105) for 2026H1. If your version is older, the system is vulnerable.

Impact Analysis

The vulnerability could allow an attacker to crash or slow down the Tanium Findings service by sending specially crafted compressed data, disrupting normal operations.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The vulnerability involves a compression bomb issue in Tanium Findings, which may impact availability but lacks details on regulatory implications.

Mitigation Strategies

Update Tanium Findings to the latest version to address the compression bomb vulnerability. Monitor network traffic for unusual compression patterns or resource exhaustion.

Hi! I’m here to help you understand CVE-2026-11617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70