CVE-2026-66913
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-400
Consumo de recursos no controlado (Agotamiento de recursos)
Fecha de publicación:
28/07/2026
Última modificación:
28/07/2026
Descripción
*** Pendiente de traducción *** Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.<br />
<br />
An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.<br />
<br />
The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.<br />
<br />
The patch introduces:<br />
<br />
* A 1 GB cumulative uncompressed-size limit for imported capture archives.<br />
* Size-limited gzip and zlib decompression for compressed HAR files.<br />
* Explicit detection and handling of suspected zip bombs.<br />
* An HTTP 400 response when an oversized compressed HAR file is submitted through the API.
Impacto
Puntuación base 4.0
6.90
Gravedad 4.0
MEDIA