[C/C++]: DOS through Decompression

[am0o0]

Query PR

github/codeql#13560

Language

C/C++

CVE(s) ID list

• CVE-2020-25866
• CVE-2022-29225
• CVE-2016-10544

CWE

No response

Report

Extracting Compressed files with any compression algorithm like gzip can cause to denial of service attacks. Attackers can compress a huge file which created by repeated similar byte and convert it to a small compressed file.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

No response

[Kwstubbs]

@amammad could I get a database for one of these CVES? thanks

[Kwstubbs]

@am0o0 pinging for CodeQL database so I start scoring

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed