CVE-2026-115397
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Oct 22, 2026
CISA due date
—
The record
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption… CWE-770
- CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows… CWE-770
- CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening… CWE-770
- CVE-2026-116128 Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded… CWE-770
- CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for… CWE-770
- CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. CWE-770
- CVE-2026-90991 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-770
- CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps… CWE-770