CVE-2026-61449

The record

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header (ZipArchive::statIndex()['size']) and rejects archives exceeding system.gpm.archive.max_uncompressed_size before extraction. Because this declared size is attacker-forgeable and is not cross-checked against the actual inflated stream, a crafted archive declaring tiny per-entry sizes passes the cap while extractTo() writes the real, much larger content, filling disk or exhausting inodes. The archive must be supplied by a package source or admin upload (admin/operator trust). Fixed in 2.0.2. This is an incomplete fix for GHSA-928x-9mpw-8h56.

Affected packages

Related vulnerabilities

• CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… CWE-409
• CVE-2026-118261 Echo is a Go web framework. CWE-409
• CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a… CWE-409
• CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. CWE-409
• CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted… CWE-409
• CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in… CWE-409
• CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the… CWE-409
• CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results… CWE-409