https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:14:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342198 EUVD-2026-342198 https://cve.radiocsirt.org/vuln/euvd-2026-342198 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66913 <p>Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.</p> <p>An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.</p> <p>The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.</p> <p>The patch introduces:</p> <p>* A 1 GB cumulative uncompressed-size limit for imported capture archives. * Size-limited gzip and zlib decompression for compressed HAR files. * Explicit detection and handling of suspected zip bombs. * An HTTP 400 response when an oversized compressed HAR file is submitted through the API.</p> <p>Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.</p> <p>An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.</p> <p>The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.</p> <p>The patch introduces:</p> <p>* A 1 GB cumulative uncompressed-size limit for imported capture archives. * Size-limited gzip and zlib decompression for compressed HAR files. * Explicit detection and handling of suspected zip bombs. * An HTTP 400 response when an oversized compressed HAR file is submitted through the API.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66913