CVE-2026-68924 - MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Brief
CVE ID : CVE-2026-68924
Published : Aug. 18, 2026, 6:19 p. m.
- 49 minutes ago
Description : MobSF is a mobile application security testing tool used. Prior to 4.
- 1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.
py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.
- 1.
Severity: 4.9
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...