Weaknesses of type CWE-409

134 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2026-78206HIGHexceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx DecompressionEPSS 0.4%CVE-2025-62708MEDIUMpypdf manipulated LZWDecode streams can exhaust RAMEPSS 0.4%CVE-2024-54682MEDIUMZipbomb DoS via Missing Slack Import ValidationEPSS 0.4%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.4%CVE-2026-73232HIGHffuf denial of service (OOM) via HTTP response decompression bombEPSS 0.4%CVE-2026-75936HIGHMemory-amplification denial of service via GZIP decompression bomb in Amazon ion-javaEPSS 0.4%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.4%CVE-2026-82520HIGHparsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email AttachmentsEPSS 0.4%CVE-2026-18929MEDIUMResource Exhaustion in CarboneEPSS 0.4%CVE-2026-59939HIGHhttplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response HandlingEPSS 0.4%CVE-2026-54233MEDIUMvLLM: OOM Denial of Service via Audio Decompression BombEPSS 0.4%CVE-2026-28435HIGHPayload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplibEPSS 0.4%CVE-2026-10725HIGHProtocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 BombEPSS 0.4%CVE-2026-80189HIGHLeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP ExtractionEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%CVE-2026-22776HIGHcpp-httplib vulnerable to a denial of service (DOS) using a zip bombEPSS 0.4%CVE-2026-48510MEDIUMMessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsEPSS 0.4%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.4%