# RyanDFIR Unfurl denial of service via unbounded zlib decompression

Source: https://junglewise.ai/threats/ryandfir-unfurl-denial-of-service-via-unbounded-zlib-decompression-94ce53f1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-04-09

Unfurl, a tool used for forensic URL analysis, is vulnerable to a 'decompression bomb' attack. An attacker can send a specially crafted, highly compressed data payload that, when processed, expands to gigabytes in size. This consumes all available server memory, causing the service to crash and leading to a total denial of service.

Technologies: [dfir-unfurl (PyPI)](https://junglewise.ai/threats/technologies/dfir-unfurl), [RyanDFIR Unfurl](https://junglewise.ai/threats/technologies/unfurl). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [RyanDFIR](https://junglewise.ai/threats/vendors/ryandfir).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 9 April 2026.

**Which products and versions are affected?** dfir-unfurl (PyPI) < 2026.04; RyanDFIR Unfurl < 2026.04.

**Is there a fix for This vulnerability?** A patch was published on 2026-04-10: Version 2026.04 released and duplicate advisory withdrawn Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run dfir-unfurl (PyPI) or RyanDFIR Unfurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Unfurl's 'parse_compressed.py' component utilizes 'zlib.decompress()' without specifying a maximum output size (maxsize). This allows a remote, unauthenticated attacker to submit a 'decompression bomb'—a small, highly compressed base64-encoded payload—via URL parameters to the '/json/visjs' endpoint. Upon processing, the payload expands significantly, exhausting system memory and crashing the application. The vulnerability is classified as CWE-409 (Improper Handling of Highly Compressed Data) and was addressed in version 2026.04 by implementing decompression limits.

## Affected products

- RyanDFIR unfurl < 2026.04

## Timeline

- 2026-01-28: advisory: Original advisory GHSA-h5qv-qjv4-pc5m published
- 2026-04-08: disclosed: CVE-2026-40036 published to NVD
- 2026-04-09: advisory: Duplicate advisory GHSA-c3f2-qg8v-25q2 published
- 2026-04-10: patched: Version 2026.04 released and duplicate advisory withdrawn

## References

- [https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m](https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m)
- [https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression](https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression)
- [https://github.com/RyanDFIR/unfurl/pull/243](https://github.com/RyanDFIR/unfurl/pull/243)
- [https://github.com/RyanDFIR/unfurl/releases/tag/v2026.04](https://github.com/RyanDFIR/unfurl/releases/tag/v2026.04)

## Related threats

- [RyanDFIR Unfurl denial of service via unbounded zlib decompression](https://junglewise.ai/threats/cve-2026-40036-ryandfir-unfurl-denial-of-service-via-unbounded-zlib)
- [RyanDFIR Unfurl Flask debug mode enabled by default](https://junglewise.ai/threats/cve-2026-40035-ryandfir-unfurl-flask-debug-mode-enabled-by-default)