CVE-2026-74767 in Pandora
Summary
by MITRE • 08/16/2026
Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data.
An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service.
The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within Pandora's Direct Access Archive file processing functionality where the application fails to enforce limits on decompressed data output during ISO image extraction operations. The flaw stems from improper handling of compressed data chunks that are processed through zlib.decompress() without any constraints on the maximum allowable uncompressed output size. This design oversight creates a path for malicious actors to exploit the system's decompression capabilities by crafting specially constructed DAA files containing highly compressed data sequences.
The technical implementation of this vulnerability aligns with common patterns found in decompression bomb attacks where attackers leverage the mathematical properties of compression algorithms to generate massive output from minimal input. When Pandora processes these crafted archives, each compressed chunk is decompressed and accumulated into memory as part of constructing the internal ISO image structure. The absence of any size validation mechanisms means that malicious inputs can cause exponential growth in memory consumption, leading to resource exhaustion scenarios that severely impact system availability and operational integrity.
The operational impact of this vulnerability extends beyond simple service disruption to encompass potential complete system compromise through resource exhaustion attacks. Attackers can orchestrate denial-of-service conditions that render the extraction worker unresponsive or cause process termination, effectively making the Pandora service unavailable to legitimate users. This creates a significant risk for organizations relying on Pandora for archive processing operations where continuous availability is critical for business operations and data processing workflows.
Security controls implemented in the patch address this vulnerability through proper bounded decompression techniques utilizing decompressobj().decompress() with max_extracted_filesize parameter enforcement. The solution incorporates cumulative size validation of decompressed chunks and implements dedicated ZipBomb exception handling that triggers when configured limits are exceeded. This defensive approach follows established security practices for preventing decompression bomb attacks and aligns with industry standards such as CWE-400 which categorizes excessive resource consumption vulnerabilities, and ATT&CK technique T1499.004 for resource exhaustion attacks. The implementation ensures that extraction processes terminate gracefully when encountering potentially malicious input while maintaining system stability and availability for legitimate operations through proper error handling and reporting mechanisms.