pandora-analysis Pandora up to 1.12.5 DAA File zlib.decompress resource consumption

Summaryinfo

A vulnerability identified as problematic has been detected in pandora-analysis Pandora up to 1.12.5. Affected is the function zlib.decompress of the component DAA File Handler. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2026-74767. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in pandora-analysis Pandora up to 1.12.5. This affects the function zlib.decompress of the component DAA File Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service. The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-74767 since 08/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Applying the patch f4294a873f86fbf2569c289e329fff2f52ca50c9 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-59805). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• pandora-analysis

Name

• Pandora

Version

• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.12.5

Website

• Product: https://github.com/pandora-analysis/pandora/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion