CVE-2026-18929 in Carbone
Summary
by MITRE • 08/18/2026
Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server.
The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4. The fix is available across all distribution types.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
Carbone contains a critical vulnerability that allows for Denial of Service attacks through the exploitation of zip bomb techniques during the processing of .docx files. The root cause lies in the library's use of the yazl package for decompressing ZIP archives, which lacks adequate validation mechanisms for entry sizes before extraction. When an attacker supplies a maliciously crafted .docx file containing a compressed archive with extremely small size but massive uncompressed data volume, the application server attempts to allocate memory proportional to the inflated payload rather than the original file size. This discrepancy leads to excessive memory consumption that quickly exhausts available system resources, resulting in application crashes or severe performance degradation for legitimate users relying on document generation services.
This vulnerability aligns with CWE-409, which describes improper handling of highly compressed data input leading to decompression bomb issues. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1496 Resource Hijacking via Denial of Service techniques where attackers leverage resource exhaustion rather than direct system compromise. The attack vector is particularly dangerous because .docx files are commonly used in enterprise environments for automated report generation and data processing workflows involving Carbone templates. Attackers can trigger this condition remotely by submitting specially constructed documents through any API endpoint or user interface that accepts file uploads for conversion, requiring no authentication if the service exposes public-facing document processing capabilities without additional input sanitization layers.
The operational impact extends beyond simple application instability to potential cascading failures in microservices architectures where Carbone operates as a dependency within larger business logic pipelines. Memory exhaustion can trigger automatic restarts by container orchestration platforms like Kubernetes, causing intermittent availability issues that are difficult to diagnose due to the transient nature of resource spikes. In high-throughput environments processing numerous documents concurrently, even small zip bombs can accumulate memory pressure across multiple worker processes, potentially leading to host-level instability if not properly isolated through resource limits or cgroups configuration.
The vulnerability has been addressed in specific version releases including 3.8.2, 4.26.3, and 5.4.4 of the Carbone library. These updates implement proper validation checks for decompressed data sizes relative to compressed input dimensions, ensuring that memory allocation remains proportional to reasonable expectations based on original file characteristics. Organizations utilizing older versions must upgrade immediately to mitigate risk exposure across all distribution types including npm packages, Docker images, and source code distributions.
Mitigation strategies should include upgrading to patched versions as the primary defense mechanism while implementing supplementary controls such as maximum payload size restrictions at the network or application gateway level before files reach Carbone processing engines. Input validation layers can be added to detect anomalous compression ratios typical of zip bombs by comparing compressed versus uncompressed sizes during initial parsing phases. Additionally, deploying resource monitoring and alerting systems capable of detecting sudden memory spikes associated with document processing workflows enables rapid incident response when exploitation attempts occur despite preventive measures being in place.