CVE-2026-66913

Summary

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.

An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.

The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.

The patch introduces:

• A 1 GB cumulative uncompressed-size limit for imported capture archives.
• Size-limited gzip and zlib decompression for compressed HAR files.
• Explicit detection and handling of suspected zip bombs.
• An HTTP 400 response when an oversized compressed HAR file is submitted through the API.

Affected Software

Weaknesses

• CWE-400: CWE-400 Uncontrolled Resource Consumption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/Lookyloo/lookyloo/commit/96589da290f018e356db7c0eaddf1aa501630ca7

• ←Previous
• Next→