CVE-2026-3816 Details
Description
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.
A denial-of-service vulnerability has been identified in OWASP DefectDojo versions through 2.55.4. The issue arises in the SonarQubeParser and MSDefenderParser components, specifically within the 'input_zip.read' function of 'parser.py'. This vulnerability allows for a zip bomb attack, where a small, compressed ZIP file is uploaded. Upon extraction, the file expands to a significantly larger size, consuming excessive server memory and causing an out-of-memory condition that crashes the application. The vulnerability can be exploited remotely by authenticated users with permission to upload findings.
Users are advised to upgrade to DefectDojo version 2.56.0, where this vulnerability has been addressed. The patch is available on the DefectDojo GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DefectDojo/django-DefectDojo/commit/e8f1e5131535b8fd80a7b1b3085d676295fdcd41 | [email protected] | Patch |
| https://github.com/DefectDojo/django-DefectDojo/pull/14408 | [email protected] | Issue TrackingPatch |
| https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.56.0 | [email protected] | Release Notes |
| https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md | [email protected] | ExploitThird Party Advisory |
| https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md#supporting-materialreferences | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.349782 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.349782 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.769524 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| owasp defectdojo | < 2.56.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 9, 2026 | New CVE Received | [email protected] |