Executive brief
A vulnerability in the anna-is-cute paste application allows remote attackers to crash the service or fill up its storage. The software, which is used to host and share text snippets, fails to check the size of data after it has been decompressed. By sending a specially crafted small request, an attacker can force the server to expand that data into a much larger size, leading to a denial of service by exhausting the server's memory or disk space.
Technical details
A Denial of Service (DoS) vulnerability exists in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 due to improper validation of decompressed data sizes. The application utilizes gzip_base64_serde and xz_base64_serde to decode and decompress paste content during JSON deserialization. Because the web server only enforces request-size limits on the compressed JSON payload, an attacker can submit a small, highly compressed 'zip bomb' that expands significantly upon decompression. This expanded data is then processed in memory and written to disk via webserver/src/database/models/pastes.rs::create_file, leading to memory pressure or disk exhaustion. No authentication is required to reach the affected API endpoint.
Affected products
- anna-is-cute paste 0.1.1
Timeline
- 2026-06-13: disclosed: Vulnerability details shared via GitHub Gist.
- 2026-06-15: advisory: CVE-2026-50882 published.