Fallos del tipo CWE-409

190 resultados

Tratamento inadequado de dados altamente comprimidos (amplificação de dados)

Ocorre quando a aplicação processa dados comprimidos sem validar ou limitar o tamanho descompactado, permitindo que um arquivo pequeno se expanda para gigabytes na memória. Um atacante envia um arquivo comprimido malicioso que, ao ser descompactado, consome recursos excessivos e derruba o serviço (DoS) ou causa crash.

Ejemplo

Um servidor de upload que aceita arquivos ZIP sem verificar o tamanho do conteúdo descompactado recebe um arquivo de 1 MB que, quando extraído, ocupa 50 GB. O processo trava, a memória esgota e o serviço fica indisponível para outros usuários.

Cómo mitigar

Defina limites rígidos no tamanho máximo permitido após descompactação (ex: rejeitar se ultrapassar 100 MB) e implemente timeouts. Durante a extração, monitore o tamanho em tempo real e interrompa se exceder o limite, sem confiar apenas na informação de tamanho declarada no arquivo.

CVE-2026-68911HIGHNicotine+: Decompression of peer messages can exhaust available memoryEPSS 0.3%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.3%CVE-2026-105747MEDIUMDocling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)EPSS 0.3%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.3%CVE-2026-27460MEDIUMTandoor Recipes Affected by Denial of Service via Recipe ImportEPSS 0.3%CVE-2026-25962MEDIUMMarkUs: Zip bomb in config upload enables DoSEPSS 0.3%CVE-2026-65827MEDIUMDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of serviceEPSS 0.3%CVE-2026-75476LOWTanium addressed a compression bomb vulnerability in Threat Response.EPSS 0.3%CVE-2026-11617LOWTanium addressed a compression bomb vulnerability in Findings.EPSS 0.3%CVE-2026-66054MEDIUMApache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizeEPSS 0.3%CVE-2026-94636HIGHApache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upEPSS 0.3%CVE-2026-94637HIGHApache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frameEPSS 0.3%CVE-2026-108750MEDIUMOpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text ExtractionEPSS 0.3%CVE-2026-40148MEDIUMPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsEPSS 0.3%CVE-2026-65627MEDIUMDecompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2EPSS 0.2%CVE-2026-65059HIGHFurl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesEPSS 0.2%CVE-2026-115638MEDIUMOpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka aEPSS 0.2%CVE-2026-117677—Gitea Helm chart upload decompression denial of serviceEPSS 0.2%CVE-2022-37439MEDIUMMalformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring inputEPSS 0.2%CVE-2026-106585MEDIUMIn sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly cEPSS 0.2%