Fallos del tipo CWE-409

90 resultados

Tratamento inadequado de dados altamente comprimidos (amplificação de dados)

Ocorre quando a aplicação processa dados comprimidos sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo comprimido malicioso que, ao ser descompactado, consome recursos excessivos e derruba o serviço (DoS) ou causa crash.

Ejemplo

Um servidor de upload que aceita arquivos ZIP sem verificar o tamanho do conteúdo descompactado recebe um arquivo de 1 MB que, quando extraído, ocupa 50 GB. O processo trava, a memória esgota e o serviço fica indisponível para outros usuários.

Cómo mitigar

Defina limites rígidos no tamanho máximo permitido após descompactação (ex: rejeitar se ultrapassar 100 MB) e implemente timeouts. Durante a extração, monitore o tamanho em tempo real e interrompa se exceder o limite, sem confiar apenas na informação de tamanho declarada no arquivo.

CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 28.0%CVE-2026-21441HIGHurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)EPSS 2.7%CVE-2024-43499HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2024-28180MEDIUMGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)EPSS 2.0%CVE-2017-16129—The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed responsEPSS 1.8%CVE-2022-29225HIGHZip bomb vulnerability in EnvoyEPSS 1.5%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.1%CVE-2026-49158HIGHApache Thrift: Ruby THeaderTransport ZLIB Decompression BombEPSS 1.1%CVE-2026-41608HIGHApache Thrift: Unbounded Zlib Decompression in Python THeaderTransportEPSS 1.1%CVE-2026-48586HIGHApache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size LimitEPSS 1.1%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-26483MEDIUMgosaml2 vulnerable to Denial of Service via deflate decompression bombEPSS 1.0%CVE-2024-3572HIGHXML External Entity (XXE) Vulnerability in scrapy/scrapyEPSS 0.8%CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2024-28101HIGHApollo Router's Compressed Payloads do not respect HTTP Payload LimitsEPSS 0.8%CVE-2024-7765HIGHDenial of Service in h2oai/h2o-3EPSS 0.7%CVE-2025-66471HIGHurllib3 Streaming API improperly handles highly compressed dataEPSS 0.7%CVE-2026-59932HIGHPhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionEPSS 0.7%CVE-2024-12387MEDIUMImproper Input Validation in binary-husky/gpt_academicEPSS 0.7%CVE-2026-44432HIGHurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIEPSS 0.7%