AIKIDO-2026-872070
libflate is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
libflateTL;DR
The DEFLATE and GZIP decoders continue to the next compressed block by recursively calling their own read method rather than iterating. When a stream contains a very large number of blocks, such as many consecutive empty stored blocks, each block adds another stack frame and the recursion is unbounded. Decoding crafted input can therefore exhaust the stack and abort the process, resulting in a denial of service. The fix rewrites the decoders to loop over blocks in a single reused stack frame instead of recursing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decodes untrusted or attacker-controlled compressed data.
Background info
libflate is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 2.3.0.
How to fix this
Upgrade the libflate library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant