CVE-2026-42886

Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload

State: Published
Severity: 4.9 Medium
Published: May 11, 2026
Updated: May 12, 2026
Reserved: Apr 30, 2026

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups/upload endpoint decompresses the details entry from an uploaded .audiobookshelf ZIP file entirely into memory using zip.entryData(), with no limit on the decompressed size. The upload middleware also has no file size limit. An admin user can upload a crafted ZIP containing a highly compressed details entry that, when decompressed, consumes hundreds of megabytes or gigabytes of memory, crashing the server process via out-of-memory. This vulnerability is fixed in 2.32.2.

Scores

CVSS	Score	Vector	Source
3.1	4.9 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Affected Products

Product	Versions
audiobookshelfadvplyr	< 2.33.2Affected

References

https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-4jq4-rvq8-j26h

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.