Executive brief
Unfurl, a tool used for forensic URL analysis, is vulnerable to a 'decompression bomb' attack. An attacker can send a specially crafted, highly compressed data payload that, when processed, expands to gigabytes in size. This consumes all available server memory, causing the service to crash and leading to a total denial of service.
Technical details
Unfurl's 'parse_compressed.py' component utilizes 'zlib.decompress()' without specifying a maximum output size (maxsize). This allows a remote, unauthenticated attacker to submit a 'decompression bomb'—a small, highly compressed base64-encoded payload—via URL parameters to the '/json/visjs' endpoint. Upon processing, the payload expands significantly, exhausting system memory and crashing the application. The vulnerability is classified as CWE-409 (Improper Handling of Highly Compressed Data) and was addressed in version 2026.04 by implementing decompression limits.
Affected products
- RyanDFIR unfurl < 2026.04
Timeline
- 2026-01-28: advisory: Original advisory GHSA-h5qv-qjv4-pc5m published
- 2026-04-08: disclosed: CVE-2026-40036 published to NVD
- 2026-04-09: advisory: Duplicate advisory GHSA-c3f2-qg8v-25q2 published
- 2026-04-10: patched: Version 2026.04 released and duplicate advisory withdrawn