CVE-2026-48702

Name of the Vulnerable Software and Affected Versions hauler versions prior to 2.0.1-1.1

Description The Package.Unmarshal() function in pkg/types/alpine/apk.go decompresses signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. This allows a decompression bomb—a small compressed file that expands to a massive size—to consume unbounded heap memory, leading to a fatal Go runtime out-of-memory error or an OS OOM-kill. This issue is reachable via the unauthenticated endpoints 'POST /api/v1/log/entries' and 'POST /api/v1/log/entries/retrieve', which trigger the unbounded decompression through the V001Entry.Canonicalize() and fetchExternalEntities() functions.

Recommendations Update to version 2.0.1-1.1.