{"id":"CVE-2026-40036","title":"Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service","summary":"Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-409","CWE-770"],"vendor":"ryandfir","product":"unfurl","affected":["unfurl < 2026.04"],"patched":["unfurl 2026.04"],"published":"2026-04-08","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:17:14.887","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40036","references":[{"url":"https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04","label":"disclosure@vulncheck.com"},{"url":"https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression","label":"disclosure@vulncheck.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40036"},{"url":"https://github.com/RyanDFIR/unfurl/pull/243"},{"url":"https://github.com/RyanDFIR/unfurl/commit/7cc711a65b106742a21080b755f81c17b5725aa8"},{"url":"https://github.com/RyanDFIR/unfurl/releases/tag/v2026.04"},{"url":"https://github.com/obsidianforensics/unfurl"}],"tags":["nvd","cve.org","exploit-available","osv","pip"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-04-11T03:05:38.819397Z"},"epss":0.00508,"epssPercentile":0.43197,"aliases":["GHSA-h5qv-qjv4-pc5m","PYSEC-2026-1294"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:49.989Z","slug":"CVE-2026-40036","body":"## Overview\n\nUnfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.\n\n## Affected\n\n- `unfurl < 2026.04`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `unfurl 2026.04`\n\n## Package advisory (CVE-2026-40036)\n\nAffected packages:\n\n- `dfir-unfurl < 20260405`\n\nPatched in:\n\n- `dfir-unfurl 20260405`\n\nSource: https://osv.dev/vulnerability/GHSA-h5qv-qjv4-pc5m","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210268,"id":"CVE-2026-40036","ts":1790264829141,"field":"exploit_available","old":"false","new":"true"}]}