CVE-2026-39396
Decompression Bomb Vulnerability in OpenBao OCI Plugin Causes Disk Exhaustion
Publication date: 2026-04-21
Last updated on: 2026-05-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openbao | openbao | to 2.5.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause denial of service due to disk exhaustion on the victim's server.
When the decompression bomb expands to a very large file, it fills up the disk, potentially causing cascading failures in co-located services.
Recovery can be difficult because partial files remain if the extraction process is killed mid-way, and repeated exploitation is possible on restarts or signals if auto-download is enabled.
Can you explain this vulnerability to me?
CVE-2026-39396 is a Denial of Service (DoS) vulnerability in OpenBao's OCI plugin downloader, specifically in the ExtractPluginFromImage() function.
This function extracts a plugin binary from a container image by streaming decompressed tar data using io.Copy without any upper bound on the number of bytes written.
An attacker who controls or compromises the OCI registry referenced by the victim can serve a crafted image containing a decompression bomb that expands to an arbitrarily large file, causing disk exhaustion on the victim's server.
The vulnerability exists because the tar header's Size field is never validated before copying, and all gzip layers are decompressed in memory or streaming without limits, resulting in unbounded decompression to disk.
The SHA256 integrity check is performed only after the full file is written, so the hash mismatch is detected too late to prevent disk exhaustion.
This allows attackers to replace legitimate plugin images without needing to alter their signatures.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusually large disk usage or disk exhaustion events during the extraction of OCI plugin images in OpenBao. Since the vulnerability involves unbounded decompression of tar data, signs include rapid disk space consumption and presence of very large extracted files from plugin images.
There is no direct command provided to detect the vulnerability itself, but you can check for large files created during plugin extraction or monitor disk usage with standard system tools.
- Use disk usage commands such as `df -h` to monitor available disk space.
- Use `du -sh /path/to/plugin/extraction` to check the size of extracted plugin directories.
- Monitor running OpenBao processes and check logs for errors related to disk exhaustion or failed plugin extraction.
- If possible, inspect the OCI registry configuration to verify the source of plugin images and ensure they are from trusted registries.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade OpenBao to version 2.5.3 or later, where the vulnerability has been patched.
The patch includes validating the tar header Size field against a configurable maximum before extraction and enforcing size limits on decompression to prevent disk exhaustion.
Additionally, operators should configure the max_size field (default 1 GiB) in PluginConfig to limit the maximum allowed plugin size.
Until the upgrade is applied, avoid using OCI registries that are not fully trusted or that could be compromised, as attackers can serve crafted images containing decompression bombs.
Monitor disk usage closely and consider implementing disk quotas or alerts to detect abnormal disk consumption during plugin extraction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.