CVE-2026-74767

Received Received - Intake

Denial-of-Service in Pandora via Malicious DAA File

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service. The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-74767

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in Pandora related to handling DAA files. When extracting an internal ISO image from a DAA archive, the software decompresses data using zlib without size limits. An attacker could exploit this by submitting a crafted DAA file with highly compressed data, causing excessive memory and CPU usage during decompression.

Detection Guidance

This vulnerability can be detected by monitoring for excessive memory or CPU usage during DAA file extraction. Check for processes consuming unusually high resources when handling DAA files. Use system monitoring tools like 'top', 'htop', or 'ps' to observe resource consumption. Additionally, inspect logs for extraction failures or timeouts in Pandora services.

Impact Analysis

If exploited, this vulnerability could make the Pandora service unresponsive or crash due to high memory and CPU consumption. This may lead to service disruptions, affecting availability for other users or processes relying on Pandora.

Compliance Impact

This vulnerability primarily impacts availability by causing excessive memory and CPU consumption, which could lead to service disruptions. Compliance with standards like GDPR or HIPAA may be indirectly affected if the service outage impacts data processing or access to personal data, potentially violating availability requirements. However, the CVE itself does not directly reference compliance impacts.

Mitigation Strategies

Apply the latest patch that introduces bounded decompression with max_extracted_filesize. Update Pandora to the patched version to enforce size limits during DAA file extraction. Disable or restrict access to DAA file processing if immediate patching is not possible. Monitor system resources closely for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-74767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70