PT-2026-31471 · Unfurl · Unfurl
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Unfurl versions prior to 2026.04
Description
Unfurl contains a flaw in the
parse compressed.py component due to unbounded zlib decompression. Remote attackers can leverage this to cause a denial of service. Specifically, attackers can send large, compressed payloads through URL parameters to the /json/visjs API endpoint. These payloads expand to gigabytes, consuming server memory and leading to service crashes.Recommendations
Update to version 2026.04 or later.
Exploit
Fix
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Unfurl