Samsung CredSweeper resource exhaustion in deep scanner archive processing

Executive brief

CredSweeper, a tool used to scan code for secrets, contains a vulnerability in its deep scanning feature that fails to properly limit the size of compressed files it processes. An attacker can provide a specially crafted archive (such as a 'zip bomb') that bypasses safety limits, causing the tool to consume excessive memory and CPU. This can lead to system crashes or service outages during automated security scans of untrusted code.

Technical details

A resource exhaustion vulnerability exists in CredSweeper's deep scanner due to improper enforcement of the `recursive_limit_size` parameter. The root cause is twofold: first, single-stream decompressors (GZIP, BZIP2, LZMA) fully materialize decompressed data in memory before checking the remaining budget; second, multi-entry archive scanners (ZIP, TAR, RPM) validate entries against a static budget rather than a shared, decrementing cumulative budget. An attacker can exploit this by providing nested or multi-file archives that exceed intended limits, leading to a Denial of Service (DoS) via memory or CPU exhaustion. The issue is fixed in version 1.16.0.

Affected products

• Samsung CredSweeper >= 1.4.9, < 1.16.0

Timeline

• 2026-06-03: disclosed: Initial GitHub Advisory publication
• 2026-07-10: advisory: Last updated date
• 1.16.0: patched

References

• https://api.github.com/users/0xmrma
• https://github.com/0xmrma
• https://api.github.com/users/0xmrma/gists%7B/gist_id%7D
• https://api.github.com/users/0xmrma/repos
• https://avatars.githubusercontent.com/u/197543882?v=4
• https://api.github.com/users/0xmrma/events%7B/privacy%7D