# CVE-2026-27460: Tandoor Recipes Denial of Service via ZIP Bomb in recipe import

Source: https://junglewise.ai/threats/cve-2026-27460-tandoor-recipes-denial-of-service-via-zip-bomb-in-recipe-import  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-27460 · Severity: medium · CVSS 6.5 · Published 2026-04-10

Tandoor Recipes is a self-hosted application for managing recipes and meal planning. A vulnerability in the recipe import feature allows an authenticated user to crash the server or make it unresponsive by uploading a specially crafted, highly compressed file. This can lead to a total service outage, preventing all users from accessing their data until the system is manually restarted.

Technologies: [Tandoor Recipes](https://junglewise.ai/threats/technologies/recipes). Vendors: [Tandoor](https://junglewise.ai/threats/vendors/tandoor).

## Quick answers

**Is CVE-2026-27460 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27460 being exploited in the wild.

**How severe is CVE-2026-27460?** Medium severity, with a CVSS score of 6.5, published 10 April 2026.

**Which products and versions are affected?** TandoorRecipes Tandoor Recipes < 2.6.5.

**Is there a fix for CVE-2026-27460?** A patch was published on 2026-04-10: Fixed in version 2.6.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27460 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-27460?** Check whether you run Tandoor Recipes. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Denial of Service (DoS) vulnerability exists in Tandoor Recipes prior to version 2.6.5 due to improper handling of highly compressed data (CWE-409). The 'create_from_zip' function in the recipe service extracts uploaded ZIP archives directly into memory using 'myfile.read()' without validating the uncompressed size. An authenticated attacker can upload a 'ZIP bomb'—a small archive that expands to a massive size (e.g., 20GB)—causing the server to exhaust available RAM. This results in the operating system's Out of Memory (OOM) killer terminating the application process or causing severe system degradation through disk swapping. The issue is resolved in version 2.6.5.

## Affected products

- TandoorRecipes Tandoor Recipes < 2.6.5

## Timeline

- 2026-04-10: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 2.6.5

## References

- [https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-w8pq-4pwf-r2m8](https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-w8pq-4pwf-r2m8)

## Related threats

- [Tandoor Recipes unauthorized access to other members' bookmarklets](https://junglewise.ai/threats/cve-2026-59967-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35489-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35488-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35046-tandoor-recipes-is-an-application-for-managing-recipes-planning)
- [Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4…](https://junglewise.ai/threats/cve-2026-35045-tandoor-recipes-is-an-application-for-managing-recipes-planning)