Executive brief
CodeChecker is a static code analysis platform used to identify and track software defects. An authenticated attacker can submit a specially crafted, highly compressed analysis run file that decompresses to an enormous size, exhausting server memory and disk space and causing the service to become unavailable or crash. This requires valid credentials with permission to store analysis runs.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-400, CWE-409) in CodeChecker's massStoreRun API endpoint. The vulnerable code in mass_store_run.py decompresses Base64-encoded, zlib-compressed user input via a one-shot call to zlib.decompress() without enforcing a maximum decompressed size. Because the entire decompressed payload is materialized in memory before being written to a temporary file, an attacker can submit a small compressed payload that expands to gigabytes of data, exhausting process memory, causing OOM termination, or filling disk space. The attack requires authentication with PRODUCT_STORE permission (or none if authentication is disabled). Remediation: replace unbounded zlib.decompress() with streaming decompression using zlib.decompressobj() with max_length enforcement and cumulative byte counting. The fix is available in CodeChecker 6.28.3.
Affected products
- Ericsson CodeChecker <6.28.3
Timeline
- 2026-08-25: disclosed
- 2026-08-28: patched: Version 6.28.3 released