CVE-2026-68924: MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIP_MAX_UNCOMPRESSED_FILE_SIZE (400 MB) and logs “Skipping” — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk.
References
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
- github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
- github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9
- github.com/advisories/GHSA-x768-8642-mmq9
- nvd.nist.gov/vuln/detail/CVE-2026-68924
Code Behaviors & Features
Detect and mitigate CVE-2026-68924 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →