# CVE-2026-84161: Ericsson CodeChecker unbounded zlib decompression in storeAnalysisStatistics

Source: https://junglewise.ai/threats/cve-2026-84161-when-an-operator-enables-store-analysis-statistics-dir-a-network  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-84161 · Severity: medium · CVSS 4.9 · Published 2026-11-06

CodeChecker is a static analysis tool that stores code analysis results and statistics. When statistics storage is enabled, an authenticated user with permission to store analysis data can trigger a denial-of-service attack by uploading a specially crafted compressed file that decompresses to far larger sizes, exhausting server memory and disk space. This can make the CodeChecker service unavailable to legitimate users.

Technologies: [Ericsson Codechecker](https://junglewise.ai/threats/technologies/ericsson-codechecker). Vendors: [Ericsson](https://junglewise.ai/threats/vendors/ericsson).

## Quick answers

**Is CVE-2026-84161 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84161 being exploited in the wild.

**How severe is CVE-2026-84161?** Medium severity, with a CVSS score of 4.9, published 6 November 2026.

**Which products and versions are affected?** Ericsson Codechecker before 6.29.3.

**Is there a fix for CVE-2026-84161?** Yes: fixed in CodeChecker 6.29.3. Until then: Disable the store.analysis_statistics_dir configuration option unless statistics storage is required; the feature is null by default and disabled in shipped configurations. Restrict PRODUCT_STORE permissions to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84161 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84161?** Check whether you run Ericsson Codechecker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CodeChecker 6.29.3

Disable the store.analysis_statistics_dir configuration option unless statistics storage is required; the feature is null by default and disabled in shipped configurations. Restrict PRODUCT_STORE permissions to trusted users only.

## Technical details

The vulnerability is an unbounded zlib decompression flaw (CWE-409, CWE-770) in the storeAnalysisStatistics Thrift-over-HTTP endpoint. A Base64-encoded, zlib-compressed payload sent by an authenticated user with PRODUCT_STORE permission is decompressed without enforcing a maximum output size, allowing amplification ratios exceeding 1000x. The decompressed data is materialized as a Python bytes object and written to disk, enabling both memory and persistent-storage exhaustion via denial-of-service.

## Affected products

- Ericsson CodeChecker before 6.29.3

## Timeline

- 2026-11-06: disclosed
- 2026-11-05: advisory: GHSA-w57m-6g36-jjwv published

## References

- [https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv](https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv)

## Related threats

- [CodeChecker stored XSS in HTML report export](https://junglewise.ai/threats/cve-2026-84164-the-html-report-that-plist-to-html-codechecker-parse-export-html)
- [CodeChecker session token remains valid after logout](https://junglewise.ai/threats/cve-2026-84155-codechecker-s-web-server-fails-to-fully-invalidate-a-session)
- [Codechecker has an authentication bypass for certain API calls](https://junglewise.ai/threats/cve-2026-25660-codechecker-has-an-authentication-bypass-for-certain-api-calls)
- [Ericsson CodeChecker stack overflow in ldlogger library](https://junglewise.ai/threats/cve-2025-40843-ericsson-codechecker-stack-overflow-in-ldlogger-library)