CVE-2026-40036: Allocation of Resources Without Limits or Throttling in obsidianforensics unfurl
Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.
AI Analysis
Technical Summary
CVE-2026-40036 is a resource exhaustion vulnerability in the unfurl tool by obsidianforensics. The issue arises from unbounded zlib decompression in the parse_compressed.py component. Attackers can exploit this by sending specially crafted compressed data in URL parameters to the /json/visjs endpoint, which decompresses to gigabytes of data, leading to memory exhaustion and service crashes. This vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Management of Critical State Data). No official patch or remediation is currently documented.
Potential Impact
Successful exploitation results in denial of service by exhausting server memory resources, causing the unfurl service to crash. This impacts availability but does not indicate direct compromise of data confidentiality or integrity based on the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external protections such as limiting request sizes or deploying web application firewalls to detect and block suspiciously large compressed payloads targeting the /json/visjs endpoint.
CVE-2026-40036: Allocation of Resources Without Limits or Throttling in obsidianforensics unfurl
Description
Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.
CVSS v4.0
Score 8.7high
Affected software
pkg:github/obsidianforensics/unfurlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40036 is a resource exhaustion vulnerability in the unfurl tool by obsidianforensics. The issue arises from unbounded zlib decompression in the parse_compressed.py component. Attackers can exploit this by sending specially crafted compressed data in URL parameters to the /json/visjs endpoint, which decompresses to gigabytes of data, leading to memory exhaustion and service crashes. This vulnerability is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Management of Critical State Data). No official patch or remediation is currently documented.
Potential Impact
Successful exploitation results in denial of service by exhausting server memory resources, causing the unfurl service to crash. This impacts availability but does not indicate direct compromise of data confidentiality or integrity based on the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external protections such as limiting request sizes or deploying web application firewalls to detect and block suspiciously large compressed payloads targeting the /json/visjs endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-04-08T13:39:22.099Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d6d13b1cc7ad14dab766cf
Added to database: 04/08/2026, 22:05:47 UTC
Last enriched: 07/15/2026, 10:27:11 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 139
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.