CVE-2026-22870 GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS

What is CVE-2026-22870?

CVE-2026-22870 is a high-severity vulnerability in DataDog guarddog, published on 13 Jan 2026.

Official description

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.

Weakness: CWE-409

Which versions are affected by CVE-2026-22870?

3 open source packages ship an affected version, including guarddog. It affects 1 product.

Products include Datadoghq Guarddog.

How do I fix CVE-2026-22870?

Upgrade guarddog to 2.7.1 or later.

Is CVE-2026-22870 being exploited?

There is no known exploitation of CVE-2026-22870 in the wild and no public exploit code.

Other vulnerabilities in DataDog guarddog

• CVE-2026-22871 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE High 8.7
• CVE-2022-23530 GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package Medium 5.8
• CVE-2022-23531 Arbitrary file write when scanning a specially-crafted local PyPI package Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ffj4-jq7m-9g6v, PYSEC-2026-1429.