{"items":[{"id":"NVI-00017627","kind":"vulnerability","title":"CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-9mqm-qcwf-5qhg"],"plain_summary":"GitHub lists this reviewed advisory for credsweeper. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3298ca17160e19c2aaa19482b5b6bd5a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-10T19:25:52.000Z","value":"5.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3298ca17160e19c2aaa19482b5b6bd5a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3298ca17160e19c2aaa19482b5b6bd5a","url":"https://github.com/advisories/GHSA-9mqm-qcwf-5qhg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-9mqm-qcwf-5qhg","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:12.429Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3298ca17160e19c2aaa19482b5b6bd5a"],"technology":"credsweeper","known_exclusions":[],"conditions_summary":"### Summary\nCredSweeper's deep scanner does not enforce `recursive_limit_size` as a hard limit. Several recursive scanners fully decompress or fully read attacker-controlled content before the remaining budget is validated, and `AbstractScanner.recursive_scan()` continues processing even when the residual budget is already negative.\n\nThis allows a crafted archive to bypass the intended recursive zip-bomb protection and force excessive memory / CPU consumption when deep scanning is enabled (`--depth > 0`). I confirmed this on upstream commit `8b081acf04311eafe8fbd66ea41d02b0a7a4c6f6` / package version `1.15.8`.\n\nThe issue has two closely related exploitation paths that share the same root cause:\n\n1. Single-stream decompressor bypass:\n   `gzip`, `bzip2`, and `lzma/xz` inputs are fully decompressed first, then the remaining budget is computed, and the recursive scan proceeds even if the result is negative.\n\n2. Multi-entry archive cumulative-budget bypass:\n   `zip` and `tar` entries are checked only against the original per-entry budget, not against a mutable cumulative remaining budget shared across sibling entries. Multiple individually small entries can therefore exceed the configur","public_affected_ranges":[">= 1.4.9, < 1.16.0"]}],"null_published_at":"2026-11-05T19:10:21.428Z","source_updated_at":"2026-07-10T19:25:52.000Z","source_disclosed_at":"2026-07-10T19:25:51.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:12.429Z"}],"next_cursor":null,"snapshot_revision":"42594"}