CVE-2026-40036CWE-409CWE-770denial-of-service

CVE-2026-40036

High · published April 9, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
55.8
In the wild
Unconfirmed
What it is

Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00790 · 55.8th percentile
Weaknesses
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification); CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-04-09T02:16Z
Affected products (1)
ProductVersionsFixed in
ryandfir/unfurl< 2026.042026.04
References (3)
https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04 · [email protected]https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m · [email protected]https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression · [email protected]
EPSS history
Timeline
  • 08 APR 21:35Z
    Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression
    cvelistv5