Fallos del tipo CWE-409

190 resultados

Tratamento inadequado de dados altamente comprimidos (amplificação de dados)

Ocorre quando a aplicação processa dados comprimidos sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo comprimido malicioso que, ao ser descompactado, consome recursos excessivos e derruba o serviço (DoS) ou causa crash.

Ejemplo

Um servidor de upload que aceita arquivos ZIP sem verificar o tamanho do conteúdo descompactado recebe um arquivo de 1 MB que, quando extraído, ocupa 50 GB. O processo trava, a memória esgota e o serviço fica indisponível para outros usuários.

Cómo mitigar

Defina limites rígidos no tamanho máximo permitido após descompactação (ex: rejeitar se ultrapassar 100 MB) e implemente timeouts. Durante a extração, monitore o tamanho em tempo real e interrompa se exceder o limite, sem confiar apenas na informação de tamanho declarada no arquivo.

CVE-2026-107335MEDIUMImproper Handling of Highly Compressed Data in MalcolmEPSS 0.5%CVE-2026-48594HIGHDecompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.CompressionEPSS 0.5%CVE-2023-0475MEDIUMGo-Getter Vulnerable to Decompression BombsEPSS 0.5%CVE-2026-105274LOWhex_core decompresses registry and Erlang term API responses without size limitsEPSS 0.4%CVE-2025-62708MEDIUMpypdf manipulated LZWDecode streams can exhaust RAMEPSS 0.4%CVE-2024-54682MEDIUMZipbomb DoS via Missing Slack Import ValidationEPSS 0.4%CVE-2026-89321MEDIUMPublishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entryEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-82864HIGHpdfme pdf-lib before 5.5.10 Denial of Service via Decompression BombEPSS 0.4%CVE-2026-19671HIGHImproper handling of highly compressed data (data amplification) in CISA MalcolmEPSS 0.4%CVE-2026-111073MEDIUMApache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of serviceEPSS 0.4%CVE-2026-53430HIGHgrpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1EPSS 0.4%CVE-2026-107227HIGHAsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledEPSS 0.4%CVE-2026-116579MEDIUMAutobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)EPSS 0.4%CVE-2026-54233MEDIUMvLLM: OOM Denial of Service via Audio Decompression BombEPSS 0.4%CVE-2026-14298MEDIUMBoards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in MattermostEPSS 0.4%CVE-2026-59274MEDIUMUnbounded decompression in UnZipTransformer enables zip-bomb DoSEPSS 0.4%CVE-2026-5132MEDIUMUnbounded zlib decompression in Calls SDP WebSocket messagesEPSS 0.4%CVE-2026-15814MEDIUMUploading a crafted image causes excessive memory allocation in the Mattermost ServerEPSS 0.4%CVE-2026-10819MEDIUMMattermost Server Denial of Service via Animated GIF Emoji UploadEPSS 0.4%