CVE-2026-18929

Resource Exhaustion in Carbone

State: Published
Severity: 6.9 Medium
Published: Aug 18, 2026
Updated: Aug 18, 2026
Reserved: Aug 5, 2026

Description

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server.

The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4. The fix is available across all distribution types.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L	CERT-PL

Weaknesses

CWE-409 Improper handling of highly compressed data (data amplification)

Affected Products

Product	Versions
CarboneCarbone	before 3.8.2Affected before 4.26.3Affected before 5.4.4Affected

References

https://cert.pl/en/posts/2026/08/CVE-2026-18929third-party-advisory
https://carbone.io/product
https://github.com/carboneio/carbone/commit/eb9b4cff992cc1cb1a319d7fc0cbd09160dc214epatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.