Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

dfir-unfurl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7PyPIAmendedPublished

    Unfurl's unbounded zlib decompression allows decompression bomb DoS

    CVE-2026-40036 · GHSA-h5qv-qjv4-pc5m

    Affected
    • PyPI dfir-unfurl < 20260405
    Fixed in
    20260405· Vendor fix available
    Issue
    The compressed data parser uses zlib.decompress() without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service. Details - unfurl/parsers/parsecompressed.py calls zlib.decompress(decoded) with no size limit. - Inputs are accepted from URL components that match base64 patterns. - Highly compressible payloads can expand orders of magnitude larger than their compressed size. PoC 1. Generate a payload with securitypoc/pocdecompressionbomb.py --generate-only. 2. The script creates a base64-encoded zlib payload embedded in a URL. 3. Submitting the URL to /json/visjs can cause the server to allocate large amounts of memory. 4. The script includes a --test mode but warns it can crash the service. PoC Script Impact A remote, unauthenticated attacker can cause high memory usage and potentially crash the service. The impact depends on deployment limits (process memory, URL length limits, and request…

    Recommended action: Upgrade to 20260405 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →