Executive brief
The Ultimate Sitemap Parser library, used for crawling and indexing website sitemaps, is vulnerable to a 'decompression bomb' attack. An attacker can host a specially crafted, highly compressed sitemap file that appears small during download but expands to a massive size in memory when processed. This can cause the application using the library to crash or become unresponsive due to memory exhaustion, leading to a denial of service.
Technical details
The vulnerability exists in the `gunzip` function within `usp/helpers.py`, which uses `gzip_lib.decompress()` without an output size limit. While the library implements a 100 MiB limit, this check is incorrectly applied to the compressed network bytes rather than the decompressed result. An attacker can provide a small gzip-compressed payload (e.g., ~549 KB) that expands to over 120 MiB (or significantly more) in process memory, bypassing the intended safety threshold. This leads to uncontrolled resource consumption and potential Out-of-Memory (OOM) crashes. The issue is fixed in version 1.8.1 by implementing a chunked decompression routine with a maximum output byte cap.
Affected products
- GateNLP ultimate-sitemap-parser <= 1.8.0
Timeline
- 2026-06-16: disclosed
- 2026-06-19: advisory: Last updated date
- 2026-06-19: patched: Version 1.8.1 released