https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:40:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265602 EUVD-2026-265602 https://cve.radiocsirt.org/vuln/euvd-2026-265602 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22870 <p>GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog&#39;s safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.</p> <p>GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog&#39;s safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22870 https://cve.radiocsirt.org/vuln/ghsa-ffj4-jq7m-9g6v <p><strong>Affected:</strong> PyPI: guarddog</p> <p>## Summary</p> <p>GuardDog&#39;s `safe_extract()` function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data.</p> <p>## Vulnerability Details</p> <p>**Affected Component:** `guarddog/utils/archives.py` - `safe_extract()` function **Vulnerability Type:** CWE-409 - Improper Handling of Highly Compressed Data (Zip Bomb) **Severity:** HIGH (CVSS ~8) **Attack Vector:** Network (malicious package uploaded to PyPI/npm) or local</p> <p>### Root Cause</p> <p>The `safe_extract()` function handles TAR files securely using the `tarsafe` library, but ZIP file extraction has no size validation: ```python elif zipfile.is_zipfile(source_archive): with zipfile.ZipFile(source_archive, &#34;r&#34;) as zip: for file in zip.namelist(): zip.extract(file, path=os.path.join(target_directory, file)) ```</p> <p>**Missing protections:** - ❌ No decompressed size limit - ❌ No compression ratio validation - ❌ No file count limits - ❌ No total extracted size validation</p> <p>## Impact</p> <p>### Denial of Service Scenarios</p> <p>**1. CI/CD Pipeline Disruption** - Attacker publishes malicious package to PyPI - Developer adds package to requirements.txt - CI/CD runs GuardDog scan - Disk fills (GitHub Actions: standard 14GB limit) - All deployments blocked</p> <p>**2. Resource Exhaustion** - Local development environments - Security scanning infrastru…</p> <p><strong>Affected:</strong> PyPI: guarddog</p> <p>## Summary</p> <p>GuardDog&#39;s `safe_extract()` function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data.</p> <p>## Vulnerability Details</p> <p>**Affected Component:** `guarddog/utils/archives.py` - `safe_extract()` function **Vulnerability Type:** CWE-409 - Improper Handling of Highly Compressed Data (Zip Bomb) **Severity:** HIGH (CVSS ~8) **Attack Vector:** Network (malicious package uploaded to PyPI/npm) or local</p> <p>### Root Cause</p> <p>The `safe_extract()` function handles TAR files securely using the `tarsafe` library, but ZIP file extraction has no size validation: ```python elif zipfile.is_zipfile(source_archive): with zipfile.ZipFile(source_archive, &#34;r&#34;) as zip: for file in zip.namelist(): zip.extract(file, path=os.path.join(target_directory, file)) ```</p> <p>**Missing protections:** - ❌ No decompressed size limit - ❌ No compression ratio validation - ❌ No file count limits - ❌ No total extracted size validation</p> <p>## Impact</p> <p>### Denial of Service Scenarios</p> <p>**1. CI/CD Pipeline Disruption** - Attacker publishes malicious package to PyPI - Developer adds package to requirements.txt - CI/CD runs GuardDog scan - Disk fills (GitHub Actions: standard 14GB limit) - All deployments blocked</p> <p>**2. Resource Exhaustion** - Local development environments - Security scanning infrastru…</p> https://cve.radiocsirt.org/vuln/ghsa-ffj4-jq7m-9g6v https://cve.radiocsirt.org/vuln/pysec-2026-1429 <p><strong>Affected:</strong> PyPI: guarddog</p> <p>## Summary</p> <p>GuardDog&#39;s `safe_extract()` function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data.</p> <p>## Vulnerability Details</p> <p>**Affected Component:** `guarddog/utils/archives.py` - `safe_extract()` function **Vulnerability Type:** CWE-409 - Improper Handling of Highly Compressed Data (Zip Bomb) **Severity:** HIGH (CVSS ~8) **Attack Vector:** Network (malicious package uploaded to PyPI/npm) or local</p> <p>### Root Cause</p> <p>The `safe_extract()` function handles TAR files securely using the `tarsafe` library, but ZIP file extraction has no size validation: ```python elif zipfile.is_zipfile(source_archive): with zipfile.ZipFile(source_archive, &#34;r&#34;) as zip: for file in zip.namelist(): zip.extract(file, path=os.path.join(target_directory, file)) ```</p> <p>**Missing protections:** - ❌ No decompressed size limit - ❌ No compression ratio validation - ❌ No file count limits - ❌ No total extracted size validation</p> <p>## Impact</p> <p>### Denial of Service Scenarios</p> <p>**1. CI/CD Pipeline Disruption** - Attacker publishes malicious package to PyPI - Developer adds package to requirements.txt - CI/CD runs GuardDog scan - Disk fills (GitHub Actions: standard 14GB limit) - All deployments blocked</p> <p>**2. Resource Exhaustion** - Local development environments - Security scanning infrastru…</p> <p><strong>Affected:</strong> PyPI: guarddog</p> <p>## Summary</p> <p>GuardDog&#39;s `safe_extract()` function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data.</p> <p>## Vulnerability Details</p> <p>**Affected Component:** `guarddog/utils/archives.py` - `safe_extract()` function **Vulnerability Type:** CWE-409 - Improper Handling of Highly Compressed Data (Zip Bomb) **Severity:** HIGH (CVSS ~8) **Attack Vector:** Network (malicious package uploaded to PyPI/npm) or local</p> <p>### Root Cause</p> <p>The `safe_extract()` function handles TAR files securely using the `tarsafe` library, but ZIP file extraction has no size validation: ```python elif zipfile.is_zipfile(source_archive): with zipfile.ZipFile(source_archive, &#34;r&#34;) as zip: for file in zip.namelist(): zip.extract(file, path=os.path.join(target_directory, file)) ```</p> <p>**Missing protections:** - ❌ No decompressed size limit - ❌ No compression ratio validation - ❌ No file count limits - ❌ No total extracted size validation</p> <p>## Impact</p> <p>### Denial of Service Scenarios</p> <p>**1. CI/CD Pipeline Disruption** - Attacker publishes malicious package to PyPI - Developer adds package to requirements.txt - CI/CD runs GuardDog scan - Disk fills (GitHub Actions: standard 14GB limit) - All deployments blocked</p> <p>**2. Resource Exhaustion** - Local development environments - Security scanning infrastru…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1429