CVE-2026-66913

Name of the Vulnerable Software and Affected Versions Lookyloo (affected versions not specified)

Description Lookyloo fails to enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to an excessive size during processing. Since the application decompresses this content directly in memory without limiting the output size, it can lead to memory exhaustion, termination of web or worker processes, or complete instance unavailability. This issue affects full capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation may result in a persistent denial-of-service condition, which is a state where a service is unavailable to its intended users, until the affected processes or instance are restarted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.