Executive brief
Tandoor Recipes is a self-hosted application for managing recipes and meal planning. A vulnerability in the recipe import feature allows an authenticated user to crash the server or make it unresponsive by uploading a specially crafted, highly compressed file. This can lead to a total service outage, preventing all users from accessing their data until the system is manually restarted.
Technical details
A Denial of Service (DoS) vulnerability exists in Tandoor Recipes prior to version 2.6.5 due to improper handling of highly compressed data (CWE-409). The 'create_from_zip' function in the recipe service extracts uploaded ZIP archives directly into memory using 'myfile.read()' without validating the uncompressed size. An authenticated attacker can upload a 'ZIP bomb'—a small archive that expands to a massive size (e.g., 20GB)—causing the server to exhaust available RAM. This results in the operating system's Out of Memory (OOM) killer terminating the application process or causing severe system degradation through disk swapping. The issue is resolved in version 2.6.5.
Affected products
- TandoorRecipes Tandoor Recipes < 2.6.5
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 2.6.5