Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89321

Quick assessment

Affected
Eclipse Foundation Eclipse OpenVSX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

发布功能限制了 VSIX 的压缩大小（由 控制，默认上限为 512 MB），但对解包后单个文件的大小没有任何限制。 当首次请求 时， 会通过 打开该条目，并将解压缩后的流传递给 。该方法会持续读取流直至结束，而不会统计已写入的字节数。生成的结果会被缓存到 ，而该缓存是按条目数量（上限 150 个）而非按大小进行淘汰，因此对磁盘使用量没有限制。 因此，一个仅能访问自己命名空间的发布者可以上传一个体积很小但高度可压缩的 VSIX 文件，从而让服务器在临时文件系统中写入大得多的文件。由于重复请求会直接从缓存返回，发布者可

CVSS 4.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89321

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/{namespace}/{extension}/{version}/{path}, WebResourceService opened the entry with ZipFile.getInputStream() and passed the decompressed stream to Files.copy(), which ran to the end of the stream without counting bytes written. The result was cached under java.io.tmpdir, and that cache evicted by entry count (150), not by size, so it placed no bound on disk usage. A publisher with access only to their own namespace could therefore upload a small, highly compressible VSIX and cause the server to write far larger files to the temp filesystem — repeating with different files or versions, since a repeat request is served from the cache. Impact observed: the temp filesystem filled; requests for files not already cached returned 500 with No space left on device; a failed extraction left a partial cache file that blocked later attempts at that path; publishing failed with Failed to read extension file. Metadata and already-cached files kept working, and the server did not stop. Triggering the extraction needs no authentication — only the upload does.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse OpenVSX 0.20.0 ~ 1.2.0 -

II. Public POCs for CVE-2026-89321

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89321

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89321 (1)

Vendor Advisories for CVE-2026-89321 (1)

IV. Related Vulnerabilities

Same vendor: Eclipse Foundation
Same weakness: CWE-409

V. Comments for CVE-2026-89321

No comments yet

Leave a comment