{“lastseen”:”2025-12-21T02:25:54″,”description”:”During a review of curl’s handling of response decompression, it was noticed that no limit exists on the final uncompressed data volume from compressed HTTP replies. Instead of setting constraints, the current design allows indefinite expansion during processing. This absence of limits could lead to excessive memory use under certain conditions. Rather than imposing caps by default, the system trusts input without internal safeguards. As a result, malicious payloads might trigger uncontrolled growth in output size.\\n\\nIn lib\/content_encoding.c, decompression functions like inflate_stream run in loops using a fixed buffer yet fail to monitor total output size. Consequently, one tiny compressed input may expand into excessive memory usage. Although designed for efficiency, these routines lack limits on expanded data volume. Therefore, malicious servers could trigger disproportionate resource consumption during processing.\\n\\nThis behavior appears using standard curl settings, without needing extra configurations.\\n\\nProof of Concept:\\n\\nI\u2019ve included a PDF with a complete, repeatable proof of concept\\ncurl version along with its setup\\na basic gzip compression trap host\\ncurl run using standard setup\\nnoticed rise in RSS while unpacking data\\nimportant parts of the code in lib\/content_encoding.c\\n\\nThe proof demonstrates a ~48 KB compressed reply grows to around 50 MB in memory prior to disposal.\\n\\n## Impact\\n\\nA bad server might make curl use excessive memory by sending a compressed file that expands drastically, which could fill up system RAM and stop normal operations. This happens because the –max-filesize flag only limits downloaded data size but doesn’t control how big files become after unpacking.\\n\\nSuggested Fix (high level):\\n\\nSet a changeable or fixed maximum for the uncompressed data size, then stop unpacking if that cap is passed.”,”published”:”2025-12-19T07:22:06″,”modified”:”2025-12-21T01:44:09″,”type”:”hackerone”,”title”:”curl: Unbounded memory consumption via compressed HTTP responses (gzip\/brotli\/zstd)”,”source”:””,”references”:””,”id”:”H1:3471553″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3471553″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-21T02:25:54″,”description”:”During a review of curl’s handling of response decompression, it was noticed that no limit exists on the final uncompressed data volume from compressed HTTP…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-32368","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n