hesela.devDecompression bomb
A decompression bomb is compressed input that expands into disproportionately large output and can exhaust resources when decoding is insufficiently bounded.
A valid compressed stream can amplify storage or memory demand without malformed data or nested archives. The risk is excessive resource use relative to the application's limits, not a universal compression-ratio threshold. [1]
Controls: Limit cumulative decoded bytes and processing time independently of decoder history memory. Apply output accounting across concatenated frames, not just the first frame. A decoded-size header is not a trusted allocation instruction. [2]
A bounded synthetic CLI probe decoded 4 MiB from two small-window frames under a 1 MiB decoder-memory setting. This illustrates why a window limit is not an output quota, not an attack against a deployed system. [3]
Relations
Citations
- MITRE CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
- Zstandard v1.5.7 API manual: frame content size and ZSTD_d_windowLogMax
- Hesela: Zstandard decoder windows versus decoded-output budgets
Sources & caveats
- CWE-409 describes the general weakness; the CLI observation is a fixed-input demonstration on Zstandard 1.5.5, not evidence of a vulnerability in the codec.
- Output and time budgets are engineering guidance, not a claim that the linked harness safely accepts untrusted input.