Is CVE-2026-84161 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84161 being exploited in the wild.

How severe is CVE-2026-84161?

Medium severity, with a CVSS score of 4.9, published 6 November 2026.

Which products and versions are affected?

Ericsson Codechecker before 6.29.3.

How is CVE-2026-84161 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-84161?

Check whether you run Ericsson Codechecker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84161: Ericsson CodeChecker unbounded zlib decompression in storeAnalysisStatistics

CVE-2026-84161 · Severity: medium · CVSS 4.9 · Published 2026-11-06

CodeChecker is a static analysis tool that stores code analysis results and statistics. When statistics storage is enabled, an authenticated user with permission to store analysis data can trigger a denial-of-service attack by uploading a specially crafted compressed file that decompresses to far larger sizes, exhausting server memory and disk space. This can make the CodeChecker service unavailable to legitimate users.

Technologies: Ericsson Codechecker. Vendors: Ericsson.

Quick answers

Is CVE-2026-84161 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84161 being exploited in the wild.
How severe is CVE-2026-84161?: Medium severity, with a CVSS score of 4.9, published 6 November 2026.
Which products and versions are affected?: Ericsson Codechecker before 6.29.3.
Is there a fix for CVE-2026-84161?: Yes: fixed in CodeChecker 6.29.3. Until then: Disable the store.analysis_statistics_dir configuration option unless statistics storage is required; the feature is null by default and disabled in shipped configurations. Restrict PRODUCT_STORE permissions to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84161 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-84161?: Check whether you run Ericsson Codechecker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CodeChecker 6.29.3

Disable the store.analysis_statistics_dir configuration option unless statistics storage is required; the feature is null by default and disabled in shipped configurations. Restrict PRODUCT_STORE permissions to trusted users only.

Technical details

The vulnerability is an unbounded zlib decompression flaw (CWE-409, CWE-770) in the storeAnalysisStatistics Thrift-over-HTTP endpoint. A Base64-encoded, zlib-compressed payload sent by an authenticated user with PRODUCT_STORE permission is decompressed without enforcing a maximum output size, allowing amplification ratios exceeding 1000x. The decompressed data is materialized as a Python bytes object and written to disk, enabling both memory and persistent-storage exhaustion via denial-of-service.

Affected products

Ericsson CodeChecker before 6.29.3

Timeline

2026-11-06: disclosed
2026-11-05: advisory: GHSA-w57m-6g36-jjwv published

References

https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.