Fallos del tipo CWE-409

190 resultados

Tratamento inadequado de dados altamente comprimidos (amplificação de dados)

Ocorre quando a aplicação processa dados comprimidos sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo comprimido malicioso que, ao ser descompactado, consome recursos excessivos e derruba o serviço (DoS) ou causa crash.

Ejemplo

Um servidor de upload que aceita arquivos ZIP sem verificar o tamanho do conteúdo descompactado recebe um arquivo de 1 MB que, quando extraído, ocupa 50 GB. O processo trava, a memória esgota e o serviço fica indisponível para outros usuários.

Cómo mitigar

Defina limites rígidos no tamanho máximo permitido após descompactação (ex: rejeitar se ultrapassar 100 MB) e implemente timeouts. Durante a extração, monitore o tamanho em tempo real e interrompa se exceder o limite, sem confiar apenas na informação de tamanho declarada no arquivo.

CVE-2026-78206HIGHexceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx DecompressionEPSS 0.6%CVE-2026-85721HIGHAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceEPSS 0.6%CVE-2026-81875HIGHHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceEPSS 0.6%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.6%CVE-2026-84382HIGHHTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)EPSS 0.6%CVE-2026-73232HIGHffuf denial of service (OOM) via HTTP response decompression bombEPSS 0.6%CVE-2026-63452HIGHSuricata http1: repeated brotli compression bombs can cause excessive CPU consumptionEPSS 0.6%CVE-2026-103262HIGHTornado before 6.5.9 Denial of Service via CurlAsyncHTTPClientEPSS 0.6%CVE-2025-25186MEDIUMNet::IMAP vulnerable to possible DoS by memory exhaustionEPSS 0.6%CVE-2026-70469HIGHApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsEPSS 0.6%CVE-2025-30153HIGHImproper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filterEPSS 0.6%CVE-2026-44160HIGHFluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`EPSS 0.6%CVE-2026-75936HIGHMemory-amplification denial of service via GZIP decompression bomb in Amazon ion-javaEPSS 0.6%CVE-2026-55078MEDIUMCoder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceEPSS 0.6%CVE-2026-109584HIGHHTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in BanditEPSS 0.6%CVE-2026-59193MEDIUMGrav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()EPSS 0.6%CVE-2026-49755HIGHDecompression bomb DoS in Req via auto-decoded archive and compressed response bodiesEPSS 0.6%CVE-2025-69223HIGHAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombEPSS 0.6%CVE-2026-85786HIGHIncomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaEPSS 0.6%CVE-2026-74046MEDIUMWazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip BombEPSS 0.6%