Falhas do tipo CWE-409

134 resultados

Manipulação inadequada de dados altamente comprimidos (amplificação de dados)

Ocorre quando uma aplicação processa dados comprimidos (ZIP, GZIP, etc.) sem validar ou limitar adequadamente o tamanho descompactado. Um arquivo pequeno pode explodir para gigabytes na memória, causando negação de serviço (DoS) ou travamento do sistema.

Exemplo

Um servidor web aceita upload de arquivo ZIP comprimido com 1 MB, descompacta sem verificar o tamanho final, e se expande para 10 GB na RAM, consumindo toda memória disponível e derrubando o serviço. Esse é o clássico 'zip bomb'.

Como mitigar

Valide o tamanho descompactado antes de processar: defina limites máximos de expansão (ex: máximo 100x maior que o original), monitore o crescimento em tempo real e pare se exceder, e implemente timeouts. Também considere processar em chunks ao invés de descompactar tudo de uma vez.

CVE-2026-78206HIGHexceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx DecompressionEPSS 0.4%CVE-2025-62708MEDIUMpypdf manipulated LZWDecode streams can exhaust RAMEPSS 0.4%CVE-2024-54682MEDIUMZipbomb DoS via Missing Slack Import ValidationEPSS 0.4%CVE-2026-53659HIGHhttp4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSEPSS 0.4%CVE-2026-73232HIGHffuf denial of service (OOM) via HTTP response decompression bombEPSS 0.4%CVE-2026-75936HIGHMemory-amplification denial of service via GZIP decompression bomb in Amazon ion-javaEPSS 0.4%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.4%CVE-2026-48502HIGHMessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsEPSS 0.4%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.4%CVE-2026-82520HIGHparsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email AttachmentsEPSS 0.4%CVE-2026-18929MEDIUMResource Exhaustion in CarboneEPSS 0.4%CVE-2026-59939HIGHhttplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response HandlingEPSS 0.4%CVE-2026-54233MEDIUMvLLM: OOM Denial of Service via Audio Decompression BombEPSS 0.4%CVE-2026-28435HIGHPayload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplibEPSS 0.4%CVE-2026-10725HIGHProtocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 BombEPSS 0.4%CVE-2026-80189HIGHLeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP ExtractionEPSS 0.4%CVE-2026-27809MEDIUMpsd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gapsEPSS 0.4%CVE-2026-22776HIGHcpp-httplib vulnerable to a denial of service (DOS) using a zip bombEPSS 0.4%CVE-2026-48510MEDIUMMessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsEPSS 0.4%CVE-2026-77528MEDIUMAutobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationEPSS 0.4%