CVE-2026-40036

HighCVSS 7.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

40th percentile - higher than 40% of all known CVEs

Summary

Unfurl before version 2026.04 has an unbounded zlib decompression vulnerability in parse_compressed.py. Attackers can send highly compressed payloads via URL parameters to the /json/visjs endpoint, which expand to gigabytes, exhausting server memory and causing denial of service.

Risk Assessment

A DoS attack can render the Unfurl service unavailable to legitimate users.

Recommendation

Upgrade Unfurl to version 2026.04 or later, which limits the size of decompressed data.

Other vulnerabilities in Unfurl

CVE-2026-40035Critical
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger.

Original NVD description (English source)

Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.