CVE-2026-84161 · Package
NO FIX YET
When an operator enables store.analysis_statistics_dir, a store account with PRODUCT_STORE permission can send a compressed payload that CodeChecker fully decompresses without any size limit. A large enough payload can exhaust server memory and fill the statistics disk, taking CodeChecker down.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only servers where an operator has set store.analysis_statistics_dir to a directory, which is disabled by default (null). The attacker needs a store account with PRODUCT_STORE permission for a product, and no superuser rights. Instances that leave the statistics feature disabled are not affected by this report.
Not affected if default-config, no-product-store-accounts
Who cares codechecker, python, self-hosted
store.analysis_statistics_dir in the CodeChecker server configuration and confirm it is set to a path rather than null.6.29.0 as affected.No fix yet, per the sources.
When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced.
This gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability.
The shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.