Falhas do tipo CWE-409

190 resultados

Manipulação inadequada de dados altamente comprimidos (amplificação de dados)

Ocorre quando uma aplicação processa dados comprimidos (ZIP, GZIP, etc.) sem validar ou limitar adequadamente o tamanho descompactado. Um arquivo pequeno pode explodir para gigabytes na memória, causando negação de serviço (DoS) ou travamento do sistema.

Exemplo

Um servidor web aceita upload de arquivo ZIP comprimido com 1 MB, descompacta sem verificar o tamanho final, e se expande para 10 GB na RAM, consumindo toda memória disponível e derrubando o serviço. Esse é o clássico 'zip bomb'.

Como mitigar

Valide o tamanho descompactado antes de processar: defina limites máximos de expansão (ex: máximo 100x maior que o original), monitore o crescimento em tempo real e pare se exceder, e implemente timeouts. Também considere processar em chunks ao invés de descompactar tudo de uma vez.

CVE-2026-68911HIGHNicotine+: Decompression of peer messages can exhaust available memoryEPSS 0.3%CVE-2026-61455HIGHGrav before 2.0.1 Decompression Bomb via ZipArchiverEPSS 0.3%CVE-2026-105747MEDIUMDocling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)EPSS 0.3%CVE-2026-61449HIGHGrav before 2.0.2 Decompression Bomb via Forged ZIP SizeEPSS 0.3%CVE-2026-27460MEDIUMTandoor Recipes Affected by Denial of Service via Recipe ImportEPSS 0.3%CVE-2026-25962MEDIUMMarkUs: Zip bomb in config upload enables DoSEPSS 0.3%CVE-2026-65827MEDIUMDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of serviceEPSS 0.3%CVE-2026-75476LOWTanium addressed a compression bomb vulnerability in Threat Response.EPSS 0.3%CVE-2026-11617LOWTanium addressed a compression bomb vulnerability in Findings.EPSS 0.3%CVE-2026-66054MEDIUMApache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizeEPSS 0.3%CVE-2026-94636HIGHApache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upEPSS 0.3%CVE-2026-94637HIGHApache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frameEPSS 0.3%CVE-2026-108750MEDIUMOpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text ExtractionEPSS 0.3%CVE-2026-40148MEDIUMPraisonAI Affected by Decompression Bomb DoS via Recipe Bundle Extraction Without Size LimitsEPSS 0.3%CVE-2026-65627MEDIUMDecompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2EPSS 0.2%CVE-2026-65059HIGHFurl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesEPSS 0.2%CVE-2026-115638MEDIUMOpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka aEPSS 0.2%CVE-2026-117677—Gitea Helm chart upload decompression denial of serviceEPSS 0.2%CVE-2022-37439MEDIUMMalformed ZIP file crashes Universal Forwarders and Splunk Enterprise through file monitoring inputEPSS 0.2%CVE-2026-106585MEDIUMIn sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly cEPSS 0.2%