Weaknesses of type CWE-409

190 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2026-78206HIGHexceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx DecompressionEPSS 0.6%CVE-2026-85721HIGHAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceEPSS 0.6%CVE-2026-81875HIGHHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceEPSS 0.6%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.6%CVE-2026-84382HIGHHTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)EPSS 0.6%CVE-2026-73232HIGHffuf denial of service (OOM) via HTTP response decompression bombEPSS 0.6%CVE-2026-63452HIGHSuricata http1: repeated brotli compression bombs can cause excessive CPU consumptionEPSS 0.6%CVE-2026-103262HIGHTornado before 6.5.9 Denial of Service via CurlAsyncHTTPClientEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-70469HIGHApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsEPSS 0.6%CVE-2025-30153HIGHImproper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filterEPSS 0.6%CVE-2026-44160HIGHFluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`EPSS 0.6%CVE-2026-75936HIGHMemory-amplification denial of service via GZIP decompression bomb in Amazon ion-javaEPSS 0.6%CVE-2026-55078MEDIUMCoder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceEPSS 0.6%CVE-2026-109584HIGHHTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in BanditEPSS 0.6%CVE-2026-59193MEDIUMGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()EPSS 0.6%CVE-2026-49755HIGHDecompression bomb DoS in Req via auto-decoded archive and compressed response bodiesEPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%CVE-2026-85786HIGHIncomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaEPSS 0.6%CVE-2026-74046MEDIUMWazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip BombEPSS 0.6%