CVE-2026-18929

The record

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4.  The fix is available across all distribution types.

Affected packages

Related vulnerabilities

• CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
• CVE-2026-112892 Pillow is a Python imaging library. CWE-409
• CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
• CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
• CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409
• CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. CWE-409
• CVE-2026-44162 fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. CWE-409
• CVE-2026-85786 Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow… CWE-409