CVE-2026-18929

Katalog CVE

CVSS 6.9 · Medium EPSS 0,51%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification). Skor CVSS 4.0 6.9 (Medium) menurut cert.pl.

Deskripsi (NVD)

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4.  The fix is available across all distribution types.

Rincian

Terbit di NVD

18 Agustus 2026

Terakhir diubah

28 Agustus 2026

Status NVD

Deferred

CVSS 4.0

6.9 (Medium), sumber cert.pl
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://carbone.io/
• https://cert.pl/en/posts/2026/08/CVE-2026-18929
• https://github.com/carboneio/carbone/commit/eb9b4cff992cc1cb1a319d7fc0cbd09160dc214e