Fallos del tipo CWE-409

134 resultados

Tratamento inadequado de dados altamente comprimidos (amplificação de dados)

Ocorre quando a aplicação processa dados comprimidos sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo comprimido malicioso que, ao ser descompactado, consome recursos excessivos e derruba o serviço (DoS) ou causa crash.

Ejemplo

Um servidor de upload que aceita arquivos ZIP sem verificar o tamanho do conteúdo descompactado recebe um arquivo de 1 MB que, quando extraído, ocupa 50 GB. O processo trava, a memória esgota e o serviço fica indisponível para outros usuários.

Cómo mitigar

Defina limites rígidos no tamanho máximo permitido após descompactação (ex: rejeitar se ultrapassar 100 MB) e implemente timeouts. Durante a extração, monitore o tamanho em tempo real e interrompa se exceder o limite, sem confiar apenas na informação de tamanho declarada no arquivo.

CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 34.3%CVE-2026-21441HIGHurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)EPSS 3.0%CVE-2024-43499HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2024-28180MEDIUMGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)EPSS 2.0%CVE-2017-16129—The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed responsEPSS 1.8%CVE-2022-29225HIGHZip bomb vulnerability in EnvoyEPSS 1.6%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.1%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-26483MEDIUMgosaml2 vulnerable to Denial of Service via deflate decompression bombEPSS 1.0%CVE-2026-75047MEDIUMIn JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointEPSS 0.9%CVE-2024-3572HIGHXML External Entity (XXE) Vulnerability in scrapy/scrapyEPSS 0.8%CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2024-28101HIGHApollo Router's Compressed Payloads do not respect HTTP Payload LimitsEPSS 0.8%CVE-2026-69304MEDIUMASP.NET Core Denial of Service VulnerabilityEPSS 0.8%CVE-2024-7765HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-59803HIGHrpcx - Denial of Service via Gzip Decompression Bomb in Wire ProtocolEPSS 0.7%CVE-2024-12387MEDIUMImproper Input Validation in binary-husky/gpt_academicEPSS 0.7%CVE-2026-24264HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. AEPSS 0.7%CVE-2024-12886HIGHOut-Of-Memory (OOM) Vulnerability in ollama/ollamaEPSS 0.7%CVE-2026-15709HIGHSoupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of serviceEPSS 0.7%