CVE-2026-22870
Medium · 6.5GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
CVSS
6.5
EPSS
0.5%
Published
Jan 13, 2026
CISA due date
—
The record
GuardDog's `safe_extract()` function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | guarddog | 0 | 2.7.1 |
Related vulnerabilities
- GHSA-ffj4-jq7m-9g6v GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS Same vulnerability
- GHSA-xg9w-vg3g-6m68 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE Also affects guarddog
- CVE-2026-22871 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE Also affects guarddog
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409