CVE-2026-74767 Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb
Attackers can cause denial of service in Pandora by submitting crafted DAA files that trigger excessive memory consumption during decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74767?
CVE-2026-74767 is a high-severity denial of service vulnerability in pandora-analysis pandora, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data.
An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service.
The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.
Weakness: CWE-434
Which versions are affected by CVE-2026-74767?
How do I fix CVE-2026-74767?
No fix has been published for CVE-2026-74767 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74767 being exploited?
There is no known exploitation of CVE-2026-74767 in the wild and no public exploit code.
Sources
Also known as GHSA-6vpw-p5cx-8hg6.