CVE-2026-40036 affects unfurl before version 2026.04 and is caused by unbounded zlib decompression in the parse_compressed.py module. Remote attackers can exploit this by sending specially crafted, highly compressed payloads via URL parameters to the /json/visjs endpoint. These payloads decompress to gigabytes of data, causing excessive memory consumption that leads to denial of service by crashing the server. The vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Resource Shutdown or Release). The CVSS 4.0 base score is 8.7, reflecting high severity due to network attack vector, no required privileges or user interaction, and high impact on availability. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation results in denial of service by exhausting server memory through decompression of large payloads, causing the unfurl service to crash. This impacts availability but does not indicate direct compromise of confidentiality or integrity. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing network-level protections such as limiting request sizes or disabling the vulnerable endpoint if feasible. Monitor for vendor updates and apply patches promptly once available.