CVE-2026-66913
- Source
- https://cve.org/CVERecord?id=CVE-2026-66913
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66913.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-66913
- Published
- 2026-07-28T12:19:20.977Z
- Modified
- 2026-07-30T04:01:59.994905588Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Zip Bomb in Lookyloo Capture Upload Allows Denial of Service
- Details
-
Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.
An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.
The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.
The patch introduces:
- A 1 GB cumulative uncompressed-size limit for imported capture archives.
- Size-limited gzip and zlib decompression for compressed HAR files.
- Explicit detection and handling of suspected zip bombs.
- An HTTP 400 response when an oversized compressed HAR file is submitted through the API.
- Database specific
{ "cwe_ids": [ "CWE-400" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66913.json", "cna_assigner": "CIRCL" }- References