Weaknesses of type CWE-409

134 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2025-66471HIGHurllib3 Streaming API improperly handles highly compressed dataEPSS 0.7%CVE-2026-44432HIGHurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIEPSS 0.7%CVE-2026-40192HIGHPillow is vulnerable to a FITS GZIP decompression bombEPSS 0.7%CVE-2026-29785HIGHNATS Server panic via malicious compression on leafnode portEPSS 0.7%CVE-2026-49158HIGHApache Thrift: Ruby THeaderTransport ZLIB Decompression BombEPSS 0.6%CVE-2026-23943MEDIUMPre-auth SSH DoS via unbounded zlib inflateEPSS 0.6%CVE-2024-54016MEDIUMcompression bomb attack in Apache Seata ServerEPSS 0.6%CVE-2026-48586HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-81875HIGHHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceEPSS 0.6%CVE-2026-44160HIGHFluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`EPSS 0.6%CVE-2026-55078MEDIUMCoder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceEPSS 0.6%CVE-2025-58057MEDIUMNetty's BrotliDecoder is vulnerable to DoS via zip bomb style attackEPSS 0.6%CVE-2026-59193MEDIUMGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()EPSS 0.6%CVE-2026-49755HIGHDecompression bomb DoS in Req via auto-decoded archive and compressed response bodiesEPSS 0.6%CVE-2026-41608HIGHApache Thrift: Unbounded Zlib Decompression in Python THeaderTransportEPSS 0.6%CVE-2026-49855HIGHtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)EPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%CVE-2025-32949MEDIUMPeerTube User Import Authenticated Resource ExhaustionEPSS 0.6%CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 0.6%