Weaknesses of type CWE-409

190 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2026-44163MEDIUMfluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`EPSS 0.4%CVE-2026-10725HIGHProtocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 BombEPSS 0.4%CVE-2026-92573MEDIUMApache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON renderingEPSS 0.4%CVE-2026-22776HIGHcpp-httplib vulnerable to a denial of service (DOS) using a zip bombEPSS 0.4%CVE-2026-102072HIGHJunos OS: An authenticated attacker causes a denial of service when the gRPC extension-service is enabledEPSS 0.4%CVE-2026-58107MEDIUMAuthenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRunEPSS 0.4%CVE-2026-48510MEDIUMMessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsEPSS 0.4%CVE-2024-55909MEDIUMIBM Concert Software denial of serviceEPSS 0.4%CVE-2026-58486HIGHHedgeDoc: Denial-of-service via YAML alias expansion in note frontmatterEPSS 0.4%CVE-2026-122322HIGHKyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation DecompressionEPSS 0.4%CVE-2026-44697HIGHKlever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadEPSS 0.4%CVE-2026-67232HIGHRabbitMQ: Web-MQTT decompression bombEPSS 0.4%CVE-2026-93850MEDIUMUnbounded memory consumption during PDF text extractionEPSS 0.4%CVE-2025-66019MEDIUMpypdf manipulated LZWDecode streams can exhaust RAMEPSS 0.4%CVE-2025-63914MEDIUMAn issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not cheEPSS 0.4%CVE-2026-77021MEDIUMMissing decompression size limit in agent receiver allows memory exhaustion via push agent dataEPSS 0.4%CVE-2026-116662HIGHTanium addressed a compression bomb vulnerability in Enforce.EPSS 0.4%CVE-2026-96637HIGHPillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSEPSS 0.4%CVE-2026-95502MEDIUMGit Sync memory exhaustion via a malicious Git serverEPSS 0.4%CVE-2026-118261HIGHEcho: Decompress permits unbounded gzip expansion in v4EPSS 0.4%