Medium, CVSS 5.5PyPIAmendedPublished
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
GHSA-9mqm-qcwf-5qhg
- Affected
- PyPI credsweeper >= 1.4.9, < 1.16.0
- Fixed in
- 1.16.0· Vendor fix available
- Issue
- CredSweeper's deep scanner does not enforce recursivelimitsize as a hard limit. Several recursive scanners fully decompress or fully read attacker-controlled content before the remaining budget is validated, and AbstractScanner.recursivescan() continues processing even when the residual budget is already negative. This allows a crafted archive to bypass the intended recursive zip-bomb protection and force excessive memory / CPU consumption when deep scanning is enabled (--depth 0). I confirmed this on upstream commit 8b081acf04311eafe8fbd66ea41d02b0a7a4c6f6 / package version 1.15.8. The issue has two closely related exploitation paths that share the same root cause: 1. Single-stream decompressor bypass: gzip, bzip2, and lzma/xz inputs are fully decompressed first, then the remaining budget is computed, and the recursive scan proceeds even if the result is negative. 2. Multi-entry archive cumulative-budget bypass: zip and tar entries are checked only against the original…
Recommended action: Upgrade to 1.16.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.