CVE-2026-40036
High · 7.5CVSS
7.5
EPSS
0.8%
Published
Apr 8, 2026
CISA due date
—
The record
Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | dfir-unfurl | 0 | No fix |
Related vulnerabilities
- GHSA-h5qv-qjv4-pc5m Unfurl's unbounded zlib decompression allows decompression bomb DoS Same vulnerability
- GHSA-vg9h-jx4v-cwx2 Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger… Also affects dfir-unfurl
- CVE-2026-92823 A flaw was found in libmodulemd. CWE-409
- CVE-2026-112892 Pillow is a Python imaging library. CWE-409
- CVE-2026-107227 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-409
- CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-409
- CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet… CWE-409
- CVE-2026-84384 libheif is a HEIF and AVIF file format decoder and encoder. CWE-409