CVE-2026-58107
Received Received - Intake

Memory Exhaustion in CodeChecker massStoreRun

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Ericsson

Description
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-58107
EUVD
EUVD-2026-67717

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
codechecker massstore *-*
ericsson codechecker to 6.28.3 (exc)
ericsson codechecker From 6.28.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves CodeChecker's massStoreRun processing path performing one-shot decompression of Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with storage permissions can submit a highly compressed payload that expands significantly when decompressed. The entire decompressed output is loaded into memory before being written to a temporary file, potentially exhausting system memory and disk space, leading to denial of service.

Detection Guidance

Monitor for unusual memory or disk usage spikes during CodeChecker operations. Check for large temporary files in system temp directories. Review logs for failed decompression attempts or out-of-memory errors in CodeChecker processes.

Impact Analysis

This vulnerability can impact you by causing system outages due to memory exhaustion or disk space depletion. If exploited, it may lead to denial of service, making CodeChecker or the affected system unavailable for legitimate users. Systems with limited resources are particularly vulnerable.

Mitigation Strategies

Upgrade CodeChecker to version 6.28.3 or later. Implement size limits on decompressed data before processing. Replace one-shot decompression with streaming decompression methods. Restrict authenticated users' storage permissions as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart