CVE-2026-58107: Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

Severity: medium (CVSS 5.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-01
Weakness: CWE-409

Description

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.

Affected products

Ericsson CodeChecker: before 6.28.3 — fixed in 6.28.3

How to fix

Upgrade to a fixed version: Ericsson CodeChecker 6.28.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-58107 or the next vulnerability affects your stack