Weaknesses of type CWE-409

190 results

Manipulação inadequada de dados altamente compactados (amplificação de dados)

Ocorre quando uma aplicação processa dados compactados (ZIP, GZIP, etc.) sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo malicioso que causa consumo excessivo de CPU, memória ou disco, derribando o serviço.

Example

Um servidor aceita uploads de arquivos compactados para backup sem verificar o tamanho final. Um arquivo de 10 MB compactado se descompacta para 10 GB, esgotando a memória disponível e travando o servidor. Esse é o ataque 'zip bomb' clássico.

How to mitigate

Estabeleça limites: defina um tamanho máximo aceitável para dados descompactados antes de processar, implemente timeouts de descompactação, e monitore consumo de memória durante a expansão. Valide a integridade e origem dos arquivos compactados recebidos.

CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.3%CVE-2026-105747MEDIUMDocling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)EPSS 0.3%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.3%CVE-2026-27460MEDIUMTandoor Recipes Affected by Denial of Service via Recipe ImportEPSS 0.3%CVE-2026-65827MEDIUMDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of serviceEPSS 0.3%CVE-2026-25962MEDIUMMarkUs: Zip bomb in config upload enables DoSEPSS 0.3%CVE-2026-11617LOWTanium addressed a compression bomb vulnerability in Findings.EPSS 0.3%CVE-2026-75476LOWTanium addressed a compression bomb vulnerability in Threat Response.EPSS 0.3%CVE-2026-66054MEDIUMApache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizeEPSS 0.3%CVE-2026-94637HIGHApache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frameEPSS 0.3%CVE-2026-94636HIGHApache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upEPSS 0.3%CVE-2026-108750MEDIUMOpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text ExtractionEPSS 0.3%CVE-2026-65627MEDIUMDecompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2EPSS 0.2%CVE-2026-40148MEDIUMPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsEPSS 0.2%CVE-2026-65059—Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesEPSS 0.2%CVE-2026-115638MEDIUMOpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka aEPSS 0.2%CVE-2026-117677—Gitea Helm chart upload decompression denial of serviceEPSS 0.2%CVE-2026-111073MEDIUMApache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of serviceEPSS 0.2%CVE-2022-37439MEDIUMMalformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring inputEPSS 0.2%CVE-2026-106585MEDIUMIn sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly cEPSS 0.2%