Vulnerability Description
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Datadoghq | Guarddog | < 2.7.1 |
Related Weaknesses (CWE)
References
- https://github.com/DataDog/guarddog/commit/c3fb07b4838945f42497e78b7a02bcfb1e639Patch
- https://github.com/DataDog/guarddog/security/advisories/GHSA-ffj4-jq7m-9g6vThird Party AdvisoryExploit
FAQ
What is CVE-2026-22870?
CVE-2026-22870 is a vulnerability with a CVSS score of 7.5 (HIGH). GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), al...
How severe is CVE-2026-22870?
CVE-2026-22870 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22870?
Check the references section above for vendor advisories and patch information. Affected products include: Datadoghq Guarddog.