Falhas do tipo CWE-409

134 resultados

Manipulação inadequada de dados altamente comprimidos (amplificação de dados)

Ocorre quando uma aplicação processa dados comprimidos (ZIP, GZIP, etc.) sem validar ou limitar adequadamente o tamanho descompactado. Um arquivo pequeno pode explodir para gigabytes na memória, causando negação de serviço (DoS) ou travamento do sistema.

Exemplo

Um servidor web aceita upload de arquivo ZIP comprimido com 1 MB, descompacta sem verificar o tamanho final, e se expande para 10 GB na RAM, consumindo toda memória disponível e derrubando o serviço. Esse é o clássico 'zip bomb'.

Como mitigar

Valide o tamanho descompactado antes de processar: defina limites máximos de expansão (ex: máximo 100x maior que o original), monitore o crescimento em tempo real e pare se exceder, e implemente timeouts. Também considere processar em chunks ao invés de descompactar tudo de uma vez.

CVE-2026-58486HIGHHedgeDoc: Denial-of-service via YAML alias expansion in note frontmatterEPSS 0.4%CVE-2026-54278MEDIUMAIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During CleanupEPSS 0.4%CVE-2026-92000HIGHadm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed SizeEPSS 0.4%CVE-2026-19671HIGHImproper handling of highly compressed data (data amplification) in CISA MalcolmEPSS 0.4%CVE-2026-44697HIGHKlever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadEPSS 0.4%CVE-2026-59932HIGHPhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionEPSS 0.4%CVE-2024-55909MEDIUMIBM Concert Software denial of serviceEPSS 0.4%CVE-2026-61690MEDIUMGrav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsEPSS 0.4%CVE-2025-66019MEDIUMpypdf manipulated LZWDecode streams can exhaust RAMEPSS 0.4%CVE-2026-63452HIGHSuricata http1: repeated brotli compression bombs can cause excessive CPU consumptionEPSS 0.4%CVE-2025-63914MEDIUMAn issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.py file does not cheEPSS 0.4%CVE-2026-44162LOWfluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`EPSS 0.4%CVE-2026-85721HIGHAsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceEPSS 0.4%CVE-2026-84382HIGHHTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)EPSS 0.4%CVE-2026-53430HIGHgrpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1EPSS 0.3%CVE-2026-74046MEDIUMWazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip BombEPSS 0.3%CVE-2026-3114MEDIUMZip Bomb Denial of Service via Unrestricted Archive DecompressionEPSS 0.3%CVE-2026-44163MEDIUMfluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`EPSS 0.3%CVE-2026-85786HIGHIncomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaEPSS 0.3%CVE-2026-12588MEDIUMAn attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console. The malicious detection wEPSS 0.3%