Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.

Affected: PyPI: dfir-unfurl

### Summary The compressed data parser uses `zlib.decompress()` without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.

### Details - `unfurl/parsers/parse_compressed.py` calls `zlib.decompress(decoded)` with no size limit. - Inputs are accepted from URL components that match base64 patterns. - Highly compressible payloads can expand orders of magnitude larger than their compressed size.

### PoC 1. Generate a payload with `security_poc/poc_decompression_bomb.py --generate-only`. 2. The script creates a base64-encoded zlib payload embedded in a URL. 3. Submitting the URL to `/json/visjs` can cause the server to allocate large amounts of memory. 4. The script includes a `--test` mode but warns it can crash the service.

### PoC Script ```python #!/usr/bin/env python3 """ Unfurl Decompression Bomb Proof of Concept ==========================================

This PoC demonstrates a Denial of Service vulnerability in Unfurl's compressed data parsing. The zlib.decompress() call has no size limits, allowing an attacker to submit small payloads that expand to gigabytes.

Vulnerability Location: - parse_compressed.py:81-82: inflated_bytes = zlib.decompress(decoded) # No maxsize parameter

Attack Impact: - Memory exhaustion - Service crash - Resource consumption (cloud cost attacks)

Usage: python poc_decompression_bomb.py [--target URL] [--size SIZE_MB] """

import argparse import…

Affected: PyPI: dfir-unfurl

### Summary The compressed data parser uses `zlib.decompress()` without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.

### Details - `unfurl/parsers/parse_compressed.py` calls `zlib.decompress(decoded)` with no size limit. - Inputs are accepted from URL components that match base64 patterns. - Highly compressible payloads can expand orders of magnitude larger than their compressed size.

### PoC 1. Generate a payload with `security_poc/poc_decompression_bomb.py --generate-only`. 2. The script creates a base64-encoded zlib payload embedded in a URL. 3. Submitting the URL to `/json/visjs` can cause the server to allocate large amounts of memory. 4. The script includes a `--test` mode but warns it can crash the service.

### PoC Script ```python #!/usr/bin/env python3 """ Unfurl Decompression Bomb Proof of Concept ==========================================

This PoC demonstrates a Denial of Service vulnerability in Unfurl's compressed data parsing. The zlib.decompress() call has no size limits, allowing an attacker to submit small payloads that expand to gigabytes.

Vulnerability Location: - parse_compressed.py:81-82: inflated_bytes = zlib.decompress(decoded) # No maxsize parameter

Attack Impact: - Memory exhaustion - Service crash - Resource consumption (cloud cost attacks)

Usage: python poc_decompression_bomb.py [--target URL] [--size SIZE_MB] """

import argparse import…