Fallos del tipo CWE-409

190 resultados

Tratamento inadequado de dados altamente comprimidos (amplificação de dados)

Ocorre quando a aplicação processa dados comprimidos sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo comprimido malicioso que, ao ser descompactado, consome recursos excessivos e derruba o serviço (DoS) ou causa crash.

Ejemplo

Um servidor de upload que aceita arquivos ZIP sem verificar o tamanho do conteúdo descompactado recebe um arquivo de 1 MB que, quando extraído, ocupa 50 GB. O processo trava, a memória esgota e o serviço fica indisponível para outros usuários.

Cómo mitigar

Defina limites rígidos no tamanho máximo permitido após descompactação (ex: rejeitar se ultrapassar 100 MB) e implemente timeouts. Durante a extração, monitore o tamanho em tempo real e interrompa se exceder o limite, sem confiar apenas na informação de tamanho declarada no arquivo.

CVE-2025-32949MEDIUMPeerTube User Import Authenticated Resource ExhaustionEPSS 0.6%CVE-2026-49855HIGHtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)EPSS 0.6%CVE-2026-97200HIGHUnbounded response body buffering and decompression in hackneyEPSS 0.6%CVE-2026-109226HIGHSGLang through 0.5.21 Audio Decompression Amplification via load_audioEPSS 0.6%CVE-2026-80189HIGHLeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP ExtractionEPSS 0.5%CVE-2026-54314MEDIUMn8n: Denial of Service via ZIP decompression in webhook workflowEPSS 0.5%CVE-2026-109398HIGHGumlet php-image-resize before 3.0.1 Denial of Service via Decompression BombsEPSS 0.5%CVE-2026-27571MEDIUMnats-server websockets are vulnerable to pre-auth memory DoSEPSS 0.5%CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%CVE-2026-61690MEDIUMGrav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsEPSS 0.5%CVE-2025-66909HIGHTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCEPSS 0.5%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.5%CVE-2026-54556HIGHHttp4s: HTTP/2 Denial of Service with Ember BackendEPSS 0.5%CVE-2026-77620HIGHVector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).EPSS 0.5%CVE-2026-62963HIGHCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportEPSS 0.5%CVE-2026-113873HIGHSmileCDR HAPI FHIR improper data decompressionEPSS 0.5%CVE-2026-90555HIGHvLLM before 0.28.0 Denial of Service via Audio HeaderEPSS 0.5%CVE-2026-40036HIGHUnfurl < 2026.04 - Denial of Service via Unbounded zlib DecompressionEPSS 0.5%CVE-2026-84384HIGHlibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoSEPSS 0.5%