{
  "status": "unknown",
  "advantages": [],
  "limitations": [],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-17",
  "slug": "decompression-bomb",
  "term": "Decompression bomb",
  "aliases": [
    "compression bomb"
  ],
  "definition": "A decompression bomb is compressed input that expands into disproportionately large output and can exhaust resources when decoding is insufficiently bounded.",
  "note": "A valid compressed stream can amplify storage or memory demand without malformed data or nested archives. The risk is excessive resource use relative to the application's limits, not a universal compression-ratio threshold. [cwe409]\n\nControls: Limit cumulative decoded bytes and processing time independently of decoder history memory. Apply output accounting across concatenated frames, not just the first frame. A decoded-size header is not a trusted allocation instruction. [zstd-api]\n\nA bounded synthetic CLI probe decoded 4 MiB from two small-window frames under a 1 MiB decoder-memory setting. This illustrates why a window limit is not an output quota, not an attack against a deployed system. [hesela-resources]",
  "related": [
    "zstandard",
    "zstd-window-size",
    "backup-verification",
    "compression-dictionary"
  ],
  "citations": [
    {
      "id": "cwe409",
      "title": "MITRE CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
      "url": "https://cwe.mitre.org/data/definitions/409.html",
      "accessed": "2026-10-17"
    },
    {
      "id": "zstd-api",
      "title": "Zstandard v1.5.7 API manual: frame content size and ZSTD_d_windowLogMax",
      "url": "https://facebook.github.io/zstd/doc/api_manual_v1.5.7.html",
      "accessed": "2026-10-17"
    },
    {
      "id": "hesela-resources",
      "title": "Hesela: Zstandard decoder windows versus decoded-output budgets",
      "url": "https://hesela.com/analyses/compressed-archives-dictionary-dependencies/#resources",
      "accessed": "2026-10-17"
    }
  ],
  "provenance": [
    "CWE-409 describes the general weakness; the CLI observation is a fixed-input demonstration on Zstandard 1.5.5, not evidence of a vulnerability in the codec.",
    "Output and time budgets are engineering guidance, not a claim that the linked harness safely accepts untrusted input."
  ]
}