CVE-2026-22870— GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
Quick assessment
Affected
DataDog guarddog
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GuardDog是GuardDog开源的一个 CLI 工具，允许识别恶意PyPI包。 GuardDog 2.7.1之前版本存在安全漏洞，该漏洞源于safe_extract()函数未验证解压缩文件大小，可能导致通过zip炸弹进行拒绝服务攻击。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-22870
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
Source: CVE Program / CVE List V5
Vulnerability Description
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Vulnerability Title
GuardDog 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GuardDog是GuardDog开源的一个 CLI 工具，允许识别恶意PyPI包。 GuardDog 2.7.1之前版本存在安全漏洞，该漏洞源于safe_extract()函数未验证解压缩文件大小，可能导致通过zip炸弹进行拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-22870
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22870
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: guarddog
-
CVE-2026-44971
GuardDog: Blind GitHub URL rewrite in remote project scannin -
CVE-2026-44972
GuardDog: Unsanitized human-readable scan output allows term -
CVE-2026-22871
GuardDog Path Traversal Vulnerability Leads to Arbitrary Fil -
CVE-2022-23531
Arbitrary file write when scanning a specially-crafted local -
CVE-2022-23530
GuardDog vulnerable to arbitrary file write when scanning a
Same vendor: DataDog
-
CVE-2026-50277
dd-trace-cpp: Improper parsing of W3C baggage headers may le -
CVE-2026-50275
Datadog PHP Tracer: Improper parsing of W3C baggage headers -
CVE-2026-50276
dd-trace-rb: Improper parsing of W3C baggage headers may lea -
CVE-2026-50270
dd-trace-java: Improper parsing of W3C baggage headers may l -
CVE-2026-54788
dd-trace-rs: Unbounded W3C tracestate parsing may lead to Do
Same weakness: CWE-409
-
CVE-2026-94637
Apache Thrift: Go `THeaderTransport` does not bound the infl -
CVE-2026-94636
Apache Thrift: Python `TZlibTransport` stops enforcing its d -
CVE-2026-103262
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClie -
CVE-2026-68911
Nicotine+: Decompression of peer messages can exhaust availa -
CVE-2026-92573
Apache Qpid Broker-J: Uncontrolled resource consumption duri
V. Comments for CVE-2026-22870
No comments yet