Executive brief
Lookyloo, a tool used for analyzing web captures and website behavior, is vulnerable to a 'zip bomb' attack. An attacker can upload a specially crafted, highly compressed file that expands to an enormous size when opened, exhausting the server's memory. This can crash the service, making the analysis platform unavailable to users until it is manually restarted.
Technical details
A vulnerability classified as CWE-400 (Uncontrolled Resource Consumption) exists in Lookyloo due to a lack of size validation during the decompression of ZIP, gzip, and zlib archives. The application processes these files directly in memory without checking the uncompressed size, enabling 'zip bomb' attacks. An attacker can trigger this by importing a malicious capture archive or submitting compressed HAR data via the API. This results in memory exhaustion that terminates web or worker processes, leading to a persistent denial-of-service. A patch has been released that implements a 1 GB cumulative limit for archives and size-limited decompression for HAR files.
Affected products
- Lookyloo Lookyloo <= 1.40.0
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory