Weaknesses of type CWE-409

134 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2026-54314MEDIUMn8n: Denial of Service via ZIP decompression in webhook workflowEPSS 0.5%CVE-2026-70469HIGHApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsEPSS 0.5%CVE-2025-30153HIGHImproper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filterEPSS 0.5%CVE-2025-66909HIGHTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCEPSS 0.5%CVE-2026-62963HIGHCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportEPSS 0.5%CVE-2026-84384HIGHlibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoSEPSS 0.5%CVE-2026-22870HIGHGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoSEPSS 0.5%CVE-2026-68981HIGHApache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsEPSS 0.5%CVE-2026-46387HIGHSuricata http2: decompression bomb can cause denial of service in SuricataEPSS 0.5%CVE-2026-43970HIGHDecompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY FrameEPSS 0.5%CVE-2026-40036HIGHUnfurl < 2026.04 - Denial of Service via Unbounded zlib DecompressionEPSS 0.5%CVE-2026-44981HIGHCrowdSec LAPI: Denial of Service via Unbounded Gzip DecompressionEPSS 0.5%CVE-2026-2575MEDIUMKeycloak: keycloak: denial of service due to excessive samlrequest decompressionEPSS 0.5%CVE-2026-48044HIGHEnvoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosionEPSS 0.5%CVE-2026-27571MEDIUMnats-server websockets are vulnerable to pre-auth memory DoSEPSS 0.5%CVE-2024-1947MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) in GitLabEPSS 0.5%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%CVE-2026-8814MEDIUMVersions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to dEPSS 0.5%CVE-2026-48594HIGHDecompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.CompressionEPSS 0.5%CVE-2023-0475MEDIUMGo-Getter Vulnerable to Decompression BombsEPSS 0.5%