Falhas do tipo CWE-409

134 resultados

Manipulação inadequada de dados altamente comprimidos (amplificação de dados)

Ocorre quando uma aplicação processa dados comprimidos (ZIP, GZIP, etc.) sem validar ou limitar adequadamente o tamanho descompactado. Um arquivo pequeno pode explodir para gigabytes na memória, causando negação de serviço (DoS) ou travamento do sistema.

Exemplo

Um servidor web aceita upload de arquivo ZIP comprimido com 1 MB, descompacta sem verificar o tamanho final, e se expande para 10 GB na RAM, consumindo toda memória disponível e derrubando o serviço. Esse é o clássico 'zip bomb'.

Como mitigar

Valide o tamanho descompactado antes de processar: defina limites máximos de expansão (ex: máximo 100x maior que o original), monitore o crescimento em tempo real e pare se exceder, e implemente timeouts. Também considere processar em chunks ao invés de descompactar tudo de uma vez.

CVE-2026-49975HIGHApache HTTP Server: mod_http2 denial of serviceEPSS 34.3%CVE-2026-21441HIGHurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)EPSS 3.0%CVE-2024-43499HIGH.NET and Visual Studio Denial of Service VulnerabilityEPSS 2.6%CVE-2024-28180MEDIUMGo JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)EPSS 2.0%CVE-2017-16129—The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed responsEPSS 1.8%CVE-2022-29225HIGHZip bomb vulnerability in EnvoyEPSS 1.6%CVE-2026-1526HIGHundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionEPSS 1.1%CVE-2026-47774HIGHEnvoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationEPSS 1.0%CVE-2023-26483MEDIUMgosaml2 vulnerable to Denial of Service via deflate decompression bombEPSS 1.0%CVE-2026-75047MEDIUMIn JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpointEPSS 0.9%CVE-2024-3572HIGHXML External Entity (XXE) Vulnerability in scrapy/scrapyEPSS 0.8%CVE-2023-0821MEDIUMNomad Client Vulnerable to Decompression Bombs in Artifact BlockEPSS 0.8%CVE-2024-28101HIGHApollo Router's Compressed Payloads do not respect HTTP Payload LimitsEPSS 0.8%CVE-2026-69304MEDIUMASP.NET Core Denial of Service VulnerabilityEPSS 0.8%CVE-2024-7765HIGHDenial of Service in h2oai/h2o-3EPSS 0.8%CVE-2026-59803HIGHrpcx - Denial of Service via Gzip Decompression Bomb in Wire ProtocolEPSS 0.7%CVE-2024-12387MEDIUMImproper Input Validation in binary-husky/gpt_academicEPSS 0.7%CVE-2026-24264HIGHNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. AEPSS 0.7%CVE-2024-12886HIGHOut-Of-Memory (OOM) Vulnerability in ollama/ollamaEPSS 0.7%CVE-2026-15709HIGHSoupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of serviceEPSS 0.7%