CVE-2026-68924: MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIPMAXUNCOMPRESSEDTOTALSIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MobSFto a version that resolves this vulnerability.Fixed in 4.5.1
Event History
Frequently Asked Questions
Which deployments and users are in scope for this issue?
MobSF deployments prior to version 4.5.1 are affected. Exploitation requires an authenticated user who can upload a crafted ZIP or APK for processing.
What conditions must an attacker satisfy to trigger disk exhaustion?
The crafted archive must contain an oversized member that exceeds the per-file ZIP_MAX_UNCOMPRESSED_FILE_SIZE limit while the archive's cumulative uncompressed size remains below ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE. The vulnerable extraction logic logs that the member should be skipped but still extracts it.
What is the available remediation?
Upgrade MobSF to version 4.5.1, which fixes the extraction behavior. The provided information does not specify an alternative mitigation for deployments that cannot yet upgrade.