CVE-2026-18929
MediumCVSS 6.9Summary
Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4.
Risk Assessment
The risk includes application server crash, which can lead to service disruptions and system unavailability for users.
Recommendation
It is recommended to update Carbone to one of the patched versions (3.8.2, 4.26.3, or 5.4.4) and implement file size limits for uploads.
Original NVD description (English source)
Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4. The fix is available across all distribution types.