Falhas do tipo CWE-409

190 resultados

Manipulação inadequada de dados altamente comprimidos (amplificação de dados)

Ocorre quando uma aplicação processa dados comprimidos (ZIP, GZIP, etc.) sem validar ou limitar adequadamente o tamanho descompactado. Um arquivo pequeno pode explodir para gigabytes na memória, causando negação de serviço (DoS) ou travamento do sistema.

Exemplo

Um servidor web aceita upload de arquivo ZIP comprimido com 1 MB, descompacta sem verificar o tamanho final, e se expande para 10 GB na RAM, consumindo toda memória disponível e derrubando o serviço. Esse é o clássico 'zip bomb'.

Como mitigar

Valide o tamanho descompactado antes de processar: defina limites máximos de expansão (ex: máximo 100x maior que o original), monitore o crescimento em tempo real e pare se exceder, e implemente timeouts. Também considere processar em chunks ao invés de descompactar tudo de uma vez.

CVE-2025-32949MEDIUMPeerTube User Import Authenticated Resource ExhaustionEPSS 0.6%CVE-2026-49855HIGHtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)EPSS 0.6%CVE-2026-97200HIGHUnbounded response body buffering and decompression in hackneyEPSS 0.6%CVE-2026-109226HIGHSGLang through 0.5.21 Audio Decompression Amplification via load_audioEPSS 0.6%CVE-2026-80189HIGHLeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP ExtractionEPSS 0.5%CVE-2026-54314MEDIUMn8n: Denial of Service via ZIP decompression in webhook workflowEPSS 0.5%CVE-2026-109398HIGHGumlet php-image-resize before 3.0.1 Denial of Service via Decompression BombsEPSS 0.5%CVE-2026-27571MEDIUMnats-server websockets are vulnerable to pre-auth memory DoSEPSS 0.5%CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%CVE-2026-61690MEDIUMGrav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsEPSS 0.5%CVE-2025-66909HIGHTurms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an image decompression bomb denial of service vulnerability. The ExtendedOpenCEPSS 0.5%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.5%CVE-2026-54556HIGHHttp4s: HTTP/2 Denial of Service with Ember BackendEPSS 0.5%CVE-2026-77620HIGHVector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).EPSS 0.5%CVE-2026-62963HIGHCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportEPSS 0.5%CVE-2026-113873HIGHSmileCDR HAPI FHIR improper data decompressionEPSS 0.5%CVE-2026-90555HIGHvLLM before 0.28.0 Denial of Service via Audio HeaderEPSS 0.5%CVE-2026-40036HIGHUnfurl < 2026.04 - Denial of Service via Unbounded zlib DecompressionEPSS 0.5%CVE-2026-84384HIGHlibheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoSEPSS 0.5%