Falhas do tipo CWE-409

134 resultados

Manipulação inadequada de dados altamente comprimidos (amplificação de dados)

Ocorre quando uma aplicação processa dados comprimidos (ZIP, GZIP, etc.) sem validar ou limitar adequadamente o tamanho descompactado. Um arquivo pequeno pode explodir para gigabytes na memória, causando negação de serviço (DoS) ou travamento do sistema.

Exemplo

Um servidor web aceita upload de arquivo ZIP comprimido com 1 MB, descompacta sem verificar o tamanho final, e se expande para 10 GB na RAM, consumindo toda memória disponível e derrubando o serviço. Esse é o clássico 'zip bomb'.

Como mitigar

Valide o tamanho descompactado antes de processar: defina limites máximos de expansão (ex: máximo 100x maior que o original), monitore o crescimento em tempo real e pare se exceder, e implemente timeouts. Também considere processar em chunks ao invés de descompactar tudo de uma vez.

CVE-2026-54314MEDIUMn8n: Denial of Service via ZIP decompression in webhook workflowEPSS 0.5%CVE-2026-70469HIGHApache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP RequestsEPSS 0.5%CVE-2025-30153HIGHImproper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filterEPSS 0.5%CVE-2025-66909HIGHTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCEPSS 0.5%CVE-2026-62963HIGHCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportEPSS 0.5%CVE-2026-84384HIGHlibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoSEPSS 0.5%CVE-2026-22870HIGHGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoSEPSS 0.5%CVE-2026-68981HIGHApache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsEPSS 0.5%CVE-2026-46387HIGHSuricata http2: decompression bomb can cause denial of service in SuricataEPSS 0.5%CVE-2026-43970HIGHDecompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY FrameEPSS 0.5%CVE-2026-40036HIGHUnfurl < 2026.04 - Denial of Service via Unbounded zlib DecompressionEPSS 0.5%CVE-2026-44981HIGHCrowdSec LAPI: Denial of Service via Unbounded Gzip DecompressionEPSS 0.5%CVE-2026-2575MEDIUMKeycloak: keycloak: denial of service due to excessive samlrequest decompressionEPSS 0.5%CVE-2026-48044HIGHEnvoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosionEPSS 0.5%CVE-2026-27571MEDIUMnats-server websockets are vulnerable to pre-auth memory DoSEPSS 0.5%CVE-2024-1947MEDIUMImproper Handling of Highly Compressed Data (Data Amplification) in GitLabEPSS 0.5%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%CVE-2026-8814MEDIUMVersions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to dEPSS 0.5%CVE-2026-48594HIGHDecompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.CompressionEPSS 0.5%CVE-2023-0475MEDIUMGo-Getter Vulnerable to Decompression BombsEPSS 0.5%