Vulnerability Description
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Owasp | Defectdojo | < 2.56.0 |
Related Weaknesses (CWE)
References
- https://github.com/DefectDojo/django-DefectDojo/commit/e8f1e5131535b8fd80a7b1b30Patch
- https://github.com/DefectDojo/django-DefectDojo/pull/14408Issue TrackingPatch
- https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.56.0Release Notes
- https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfExploitThird Party Advisory
- https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfExploitThird Party Advisory
- https://vuldb.com/?ctiid.349782Permissions RequiredVDB Entry
- https://vuldb.com/?id.349782Third Party AdvisoryVDB Entry
- https://vuldb.com/?submit.769524Third Party AdvisoryVDB Entry
FAQ
What is CVE-2026-3816?
CVE-2026-3816 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderPar...
How severe is CVE-2026-3816?
CVE-2026-3816 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3816?
Check the references section above for vendor advisories and patch information. Affected products include: Owasp Defectdojo.