GHSA-h5qv-qjv4-pc5m: Unfurl's unbounded zlib decompression allows decompression bomb DoS

January 29, 2026

The compressed data parser uses zlib.decompress() without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.

References

github.com/advisories/GHSA-h5qv-qjv4-pc5m
github.com/obsidianforensics/unfurl
github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m

Code Behaviors & Features

Detect and mitigate GHSA-h5qv-qjv4-pc5m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →