Weaknesses of type CWE-409

134 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 34.3%CVE-2026-21441HIGHurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)EPSS 3.0%CVE-2024-43499HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2024-28180MEDIUMGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)EPSS 2.0%CVE-2017-16129—The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed responsEPSS 1.8%CVE-2022-29225HIGHZip bomb vulnerability in EnvoyEPSS 1.6%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.1%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-26483MEDIUMgosaml2 vulnerable to Denial of Service via deflate decompression bombEPSS 1.0%CVE-2026-75047MEDIUMIn JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointEPSS 0.9%CVE-2024-3572HIGHXML External Entity (XXE) Vulnerability in scrapy/scrapyEPSS 0.8%CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2024-28101HIGHApollo Router's Compressed Payloads do not respect HTTP Payload LimitsEPSS 0.8%CVE-2026-69304MEDIUMASP.NET Core Denial of Service VulnerabilityEPSS 0.8%CVE-2024-7765HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-59803HIGHrpcx - Denial of Service via Gzip Decompression Bomb in Wire ProtocolEPSS 0.7%CVE-2024-12387MEDIUMImproper Input Validation in binary-husky/gpt_academicEPSS 0.7%CVE-2026-24264HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. AEPSS 0.7%CVE-2024-12886HIGHOut-Of-Memory (OOM) Vulnerability in ollama/ollamaEPSS 0.7%CVE-2026-15709HIGHSoupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of serviceEPSS 0.7%