CVE-2026-68924: CWE-400: Uncontrolled Resource Consumption in MobSF Mobile-Security-Framework-MobSF
CVE-2026-68924 is a medium severity vulnerability in MobSF Mobile-Security-Framework prior to version 4.5.1. It involves uncontrolled resource consumption due to improper handling of oversized archive members during ZIP extraction. An authenticated user can upload a crafted ZIP or APK file with an oversized member that bypasses the intended size check, leading to disk space exhaustion and denial of service by preventing further scans. This issue is fixed in version 4.5.1.
AI Analysis
Technical Summary
MobSF versions prior to 4.5.1 contain a vulnerability in the unzip function located in mobsf/StaticAnalyzer/views/common/shared_func.py. When processing ZIP archives, if an archive member exceeds the ZIP_MAX_UNCOMPRESSED_FILE_SIZE, the function logs that the member is skipped but does not proceed to the next member correctly. This allows an authenticated user to upload a crafted ZIP or APK file with an oversized member that is extracted to disk if the total uncompressed size limit (ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE) has not been reached. This can lead to uncontrolled disk space consumption, potentially exhausting disk resources and preventing further scans from running. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption).
Potential Impact
An authenticated user can cause denial of service by exhausting disk space on the system running MobSF, disrupting the scanning functionality. There is no impact on confidentiality or integrity, but availability is affected due to resource exhaustion.
Mitigation Recommendations
This vulnerability is fixed in MobSF version 4.5.1. Users should upgrade to version 4.5.1 or later to remediate this issue. No other mitigation or workaround information is provided. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix in 4.5.1.
CVE-2026-68924: CWE-400: Uncontrolled Resource Consumption in MobSF Mobile-Security-Framework-MobSF
Description
CVE-2026-68924 is a medium severity vulnerability in MobSF Mobile-Security-Framework prior to version 4.5.1. It involves uncontrolled resource consumption due to improper handling of oversized archive members during ZIP extraction. An authenticated user can upload a crafted ZIP or APK file with an oversized member that bypasses the intended size check, leading to disk space exhaustion and denial of service by preventing further scans. This issue is fixed in version 4.5.1.
CVSS v3.1
Score 4.9medium
Affected software
pkg:github/mobsf/Mobile-Security-Framework-MobSFRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MobSF versions prior to 4.5.1 contain a vulnerability in the unzip function located in mobsf/StaticAnalyzer/views/common/shared_func.py. When processing ZIP archives, if an archive member exceeds the ZIP_MAX_UNCOMPRESSED_FILE_SIZE, the function logs that the member is skipped but does not proceed to the next member correctly. This allows an authenticated user to upload a crafted ZIP or APK file with an oversized member that is extracted to disk if the total uncompressed size limit (ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE) has not been reached. This can lead to uncontrolled disk space consumption, potentially exhausting disk resources and preventing further scans from running. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption).
Potential Impact
An authenticated user can cause denial of service by exhausting disk space on the system running MobSF, disrupting the scanning functionality. There is no impact on confidentiality or integrity, but availability is affected due to resource exhaustion.
Mitigation Recommendations
This vulnerability is fixed in MobSF version 4.5.1. Users should upgrade to version 4.5.1 or later to remediate this issue. No other mitigation or workaround information is provided. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix in 4.5.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-31T21:49:24.927Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a849b5fc6e8be03328d6f5c
Added to database: 08/18/2026, 17:50:23 UTC
Last enriched: 08/18/2026, 18:06:08 UTC
Last updated: 08/19/2026, 00:16:55 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.