CVE-2026-61455: Grav before 2.0.1 Decompression Bomb via ZipArchiver
Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-61455?
CVE-2026-61455 has a severity rating of 7.1, which is classified as high.
How can I fix CVE-2026-61455?
To fix CVE-2026-61455, upgrade to Grav version 2.0.1 or later.
What does CVE-2026-61455 affect?
CVE-2026-61455 affects Grav versions before 2.0.1, specifically in the ZipArchiver::extract() functionality.
What type of vulnerability is CVE-2026-61455?
CVE-2026-61455 is a decompression bomb vulnerability that can lead to denial of service.
What can attackers achieve with CVE-2026-61455?
Attackers can exploit CVE-2026-61455 by crafting ZIP archives that fill available disk space, leading to service disruption.