CVE-2026-126938: Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Zipline account and access to the partial chunked-upload endpoint. No user interaction is required.
Which deployments are affected?
Zipline versions before 4.6.4 are affected where authenticated users can perform chunked uploads. The issue concerns server-side size and quota validation for those uploads.
What is the practical impact of exploitation?
An authenticated attacker can submit small upload chunks with forged Content-Range offsets or totals, causing creation of oversized files. This can consume available disk space and result in denial of service.
How can I tell whether an instance may be affected?
An instance may be affected if it runs a Zipline version earlier than 4.6.4 and permits authenticated chunked uploads through the partial upload endpoint.