AIKIDO-2026-768129

TL;DR

ultimate-sitemap-parser enforces its 100 MiB sitemap size limit only on the compressed response body, not on the decompressed content. As a result, a malicious server can return a small .gz sitemap that passes the network-size check but expands far beyond the intended limit once decompressed in memory. This allows an attacker to trigger excessive memory consumption, potentially causing process instability, denial of service, or crashes in applications that parse sitemaps from untrusted sources. An attacker could exploit this by hosting a gzip-compressed sitemap bomb and inducing the target application to call sitemap_tree_for_homepage() on the attacker-controlled site, causing oversized decompression in memory without any output-size enforcement.