CVE-2026-66913 Details

A denial-of-service vulnerability has been identified in Lookyloo, where the application fails to impose restrictions on the decompressed size of uploaded capture archives and compressed HAR files. This issue allows an attacker to upload a malicious ZIP, gzip, or zlib-compressed capture that expands to a large size during processing. The application decompresses this data directly in memory without prior size limitations, leading to potential memory exhaustion. This could terminate a web or worker process, causing the Lookyloo instance to become unavailable. The vulnerability impacts both full capture archive imports and API submissions with gzip-compressed HAR data. Repeated exploitation could create a persistent denial-of-service condition until the affected processes or instance are restarted.

Users can update to Lookyloo version 1.40.1 or later, where this vulnerability has been addressed. The update includes a 1 GB cumulative uncompressed-size limit for imported capture archives, size-limited decompression for gzip and zlib-compressed HAR files, explicit detection and handling of suspected zip bombs, and an HTTP 400 response for oversized compressed HAR files submitted through the API.