GHSA-h5qv-qjv4-pc5m: Unfurl's unbounded zlib decompression allows decompression bomb DoS

January 29, 2026

The compressed data parser uses zlib.decompress() without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service.

References

github.com/advisories/GHSA-h5qv-qjv4-pc5m
github.com/obsidianforensics/unfurl
github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m

Code Behaviors & Features

Detect and mitigate GHSA-h5qv-qjv4-pc5m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →