The vulnerability CVE-2026-40036 affects the unfurl product by obsidianforensics, specifically in the parse_compressed.py file. It allows remote attackers to trigger unbounded resource allocation during zlib decompression via crafted URL parameters targeting the /json/visjs endpoint. This leads to excessive memory consumption and service crashes due to denial of service conditions. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on availability. There is currently no vendor advisory or patch available, and the product is not a cloud service.

Successful exploitation results in denial of service by exhausting server memory through decompression bombs submitted remotely. This disrupts availability of the unfurl service, potentially causing downtime or requiring service restarts. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external controls such as limiting request sizes, applying rate limiting, or filtering suspicious payloads targeting the /json/visjs endpoint to reduce risk of exploitation.