Advisories for Pypi/Dfir-Unfurl package

The compressed data parser uses zlib.decompress() without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.

The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.run(debug=…), so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default.