CVE-2026-58107 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun
Authenticated users can cause denial of service in CodeChecker by submitting highly compressed payloads that exhaust memory and disk space during decompression.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58107?
CVE-2026-58107 is a medium-severity denial of service vulnerability in Ericsson CodeChecker, published on 28 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size.
An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.
Which versions are affected by CVE-2026-58107?
How do I fix CVE-2026-58107?
No fix has been published for CVE-2026-58107 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-58107 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58107 exists.
Sources
Also known as GHSA-w7jw-x567-hqr4.