What’s Vulnerable › Vulnerabilities

CVE-2026-18929: Resource Exhaustion in Carbone

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-08-28
• Weakness: CWE-409

Description

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4.  The fix is available across all distribution types.

Affected products

• Carbone: before 3.8.2; before 4.26.3; before 5.4.4 — fixed in 3.8.2, 4.26.3, 5.4.4

How to fix

Upgrade to a fixed version: Carbone 3.8.2, 4.26.3, 5.4.4. Check the vendor advisory for mitigations.

References

• https://carbone.io/
• https://cert.pl/en/posts/2026/08/CVE-2026-18929
• https://github.com/carboneio/carbone/commit/eb9b4cff992cc1cb1a319d7fc0cbd09160dc214e

Get alerted when CVE-2026-18929 or the next vulnerability affects your stack