← voltar
CVE-2026-58107mediumCWE-409CWE-770

Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.5epss 0.3%
probabilidade de exploração
0.3%top 77% das CVEs
exploração observada
nãonenhuma fonte reporta
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:A/RE:L
Produtos afetados
Ericsson · CodeChecker