Pypi · Yazl · CVE-2026-18929
**Name of the Vulnerable Software and Affected Versions**
Carbone versions prior to 3.8.2
Carbone versions prior to 4.26.3
Carbone versions prior to 5.4.4
**Description**
Denial of Service occurs when processing .docx files due to a lack of protection against zip bombs. The library utilizes yazl for zip decompression but fails to validate entry sizes. This allows an attacker to provide a malicious .docx file that decompresses to an extremely large size, leading to excessive memory consumption and crashing the application server. A zip bomb is a malicious archive file designed to crash or freeze the system reading it by expanding to an enormous size upon decompression.
**Recommendations**
Update to version 3.8.2
Update to version 4.26.3
Update to version 5.4.4