CVE-2026-22870 Details
Description
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.
A denial-of-service vulnerability has been identified in GuardDog, a CLI tool for detecting malicious PyPI packages, in versions prior to 2.7.1. The issue arises in the safe_extract() function, which extracts ZIP archives (wheels, eggs) without validating decompressed file sizes. This oversight enables attackers to create zip bombs that consume excessive disk space, potentially leading to resource exhaustion. A malicious package can cause gigabytes of disk usage from just a few megabytes of compressed data.
Users can update to GuardDog version 2.7.1, which addresses the vulnerability by adding decompressed size validation and compression ratio checks for ZIP files, similar to the existing protections for TAR files.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DataDog/guarddog/commit/c3fb07b4838945f42497e78b7a02bcfb1e63969b | [email protected] | Patch |
| https://github.com/DataDog/guarddog/security/advisories/GHSA-ffj4-jq7m-9g6v | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| datadoghq guarddog | < 2.7.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 21, 2026 | Initial Analysis | [email protected] |
| Jan 13, 2026 | New CVE Received | [email protected] |