Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 9 April 2026.

Which products and versions are affected?

dfir-unfurl (PyPI) < 2026.04; RyanDFIR Unfurl < 2026.04.

Is there a fix for This vulnerability?

A patch was published on 2026-04-10: Version 2026.04 released and duplicate advisory withdrawn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run dfir-unfurl (PyPI) or RyanDFIR Unfurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

RyanDFIR Unfurl denial of service via unbounded zlib decompression

Q: Which products and versions are affected?

dfir-unfurl (PyPI) < 2026.04; RyanDFIR Unfurl < 2026.04.

Q: Is there a fix for This vulnerability?

A patch was published on 2026-04-10: Version 2026.04 released and duplicate advisory withdrawn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run dfir-unfurl (PyPI) or RyanDFIR Unfurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 7.5 · Published 2026-04-09

Unfurl, a tool used for forensic URL analysis, is vulnerable to a 'decompression bomb' attack. An attacker can send a specially crafted, highly compressed data payload that, when processed, expands to gigabytes in size. This consumes all available server memory, causing the service to crash and leading to a total denial of service.

Technologies: dfir-unfurl (PyPI), RyanDFIR Unfurl. Vendors: PyPI, RyanDFIR.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?: dfir-unfurl (PyPI) < 2026.04; RyanDFIR Unfurl < 2026.04.
Is there a fix for This vulnerability?: A patch was published on 2026-04-10: Version 2026.04 released and duplicate advisory withdrawn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run dfir-unfurl (PyPI) or RyanDFIR Unfurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Unfurl's 'parse_compressed.py' component utilizes 'zlib.decompress()' without specifying a maximum output size (maxsize). This allows a remote, unauthenticated attacker to submit a 'decompression bomb'—a small, highly compressed base64-encoded payload—via URL parameters to the '/json/visjs' endpoint. Upon processing, the payload expands significantly, exhausting system memory and crashing the application. The vulnerability is classified as CWE-409 (Improper Handling of Highly Compressed Data) and was addressed in version 2026.04 by implementing decompression limits.

Affected products

RyanDFIR unfurl < 2026.04

Timeline

2026-01-28: advisory: Original advisory GHSA-h5qv-qjv4-pc5m published
2026-04-08: disclosed: CVE-2026-40036 published to NVD
2026-04-09: advisory: Duplicate advisory GHSA-c3f2-qg8v-25q2 published
2026-04-10: patched: Version 2026.04 released and duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.