Vulnerability Description
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.
Related Weaknesses (CWE)
References
- https://github.com/Ericsson/codechecker/security/advisories/GHSA-w7jw-x567-hqr4
- https://github.com/Ericsson/codechecker/security/advisories/GHSA-w7jw-x567-hqr4
FAQ
What is CVE-2026-58107?
CVE-2026-58107 is a documented vulnerability. CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with...
How severe is CVE-2026-58107?
CVSS scoring is not yet available for CVE-2026-58107. Check NVD for updates.
Is there a patch for CVE-2026-58107?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.