Ericsson CodeChecker CVE-2025-58107: Authenticated RDoS via Unbounded zlib Decompression

Vulnerability Overview Vulnerability Name: Authenticated Remote Denial of Service via Unbounded zlib Decompression in CVE ID: CVE-2025-58107 Severity: Moderate (CVSS 4.9 / 10) Affected Versions: < 6.28.3 Fixed Version: 6.28.3 Location: Root Cause: The function performs a one-shot on attacker-controlled Base64-encoded zip data without setting a maximum decompression size limit. An attacker can submit a highly compressed payload, leading to memory or disk exhaustion and causing a denial of service. Impact Scope Requires an authenticated user (e.g., with permission) to submit analysis tasks When authentication is disabled, unauthenticated users can also trigger the vulnerability Differs from CVE-2023-49793: This vulnerability involves resource exhaustion occurring before archive extraction, so path-based protections cannot limit the memory/disk consumption of Consequences: CodeChecker service unavailability, memory/disk exhaustion, and analysis task failure or delay Remediation 1. Replace the one-shot with a bounded streaming decompression using 2. Pass a non-zero to each decompress-object's call and maintain a cumulative decompressed-bytes counter 3. Abort processing immediately when the cumulative output exceeds the configured maximum value 4. Enforce this limit before retaining output in memory or writing additional data to disk 5. Apply limits on: compressed request size, post-decompression archive size, individual decompressed file size, total decompressed file size, number of archive entries, and maximum allowed compression ratio 6. Ensure consistency with upload and analysis storage limits documented in CodeChecker documentation 7. Add regression tests using highly compressible payloads to verify that oversized decompressed outputs are rejected POC Code PoC Archive Contents: Runtime Environment: Execution Command: Expected Output: Acknowledgements Discoverer: Nir Yehoshua, Cipher Security Labs

Goal Reached Thanks to every supporter — we hit 100%!

Ericsson CodeChecker CVE-2025-58107: Authenticated RDoS via Unbounded zlib Decompression

More from this source