← volver
CVE-2026-58107mediumCWE-409CWE-770

Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.5epss 0.3%
probabilidad de explotación
0.3%top 77% de las CVE
explotación observada
noninguna fuente lo reporta
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:L
Productos afectados
Ericsson · CodeChecker