CVE-2026-22870 | THREATINT

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.

PUBLISHED Reserved 2026-01-12 | Published 2026-01-13 | Updated 2026-01-13 | Assigner GitHub_M

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Product status

< 2.7.1

affected

References

github.com/...arddog/security/advisories/GHSA-ffj4-jq7m-9g6v

github.com/...ommit/c3fb07b4838945f42497e78b7a02bcfb1e63969b

cve.org (CVE-2026-22870)

nvd.nist.gov (CVE-2026-22870)

Download JSON