{"id":"CVE-2026-84161","kind":"vulnerability","aliases":["CVE-2026-84161"],"related":[],"title":"CodeChecker: unlimited decompression lets a store account exhaust memory and disk","description":"When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced.\n\n\n\nThis gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability.\n\n\n\nThe shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report.","summary":"When an operator enables store.analysis_statistics_dir, a store account with PRODUCT_STORE permission can send a compressed payload that CodeChecker fully decompresses without any size limit. A large enough payload can exhaust server memory and fill the statistics disk, taking CodeChecker down.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["codechecker","package","python","self-hosted"],"not_affected_if":["default-config","no-product-store-accounts"],"how_to_check":"- Look for `store.analysis_statistics_dir` in the CodeChecker server configuration and confirm it is set to a path rather than null.\n- Check the CodeChecker version in use; the sources name `6.29.0` as affected.","fix":null,"status":"open","published_at":"2026-11-06T11:17:17+00:00","first_seen_at":"2026-11-06T11:41:29+00:00","triaged_at":"2026-11-06T11:42:39+00:00","updated_at":"2026-11-06T11:42:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T11:42:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"CodeChecker: unlimited decompression lets a store account exhaust memory and disk","impact":"medium","summary":"When an operator enables store.analysis_statistics_dir, a store account with PRODUCT_STORE permission can send a compressed payload that CodeChecker fully decompresses without any size limit. A large enough payload can exhaust server memory and fill the statistics disk, taking CodeChecker down.","audience":"developers","category":"package","nicknames":[],"who_cares":["codechecker","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Denial of service: API worker or host memory exhausted, disk filled","analyst_note":"Check the NVD entry and the linked vendor advisory on GitHub for the fixed version and any workaround; the sources here do not name one.","how_to_check":"- Look for `store.analysis_statistics_dir` in the CodeChecker server configuration and confirm it is set to a path rather than null.\n- Check the CodeChecker version in use; the sources name `6.29.0` as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","no-product-store-accounts"],"who_is_affected":"Only servers where an operator has set store.analysis_statistics_dir to a directory, which is disabled by default (null). The attacker needs a store account with PRODUCT_STORE permission for a product, and no superuser rights. Instances that leave the statistics feature disabled are not affected by this report.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4457,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84161':14A,17A '6.29.0':95C 'account':7A,33B,129C 'affect':188C 'amplif':139C 'api':168C 'assess':196C 'attack':99C 'attacker-control':98C 'authent':201C 'author':124C,207C 'avail':176C 'base64':101C 'bypass':208C 'byte':150C 'call':84C 'client':75C 'codecheck':1A,18B,44B,65B,94C,175C 'complet':106C,142C 'compress':41B,107C 'configur':158C 'control':100C 'correct':123C 'cve':12A,15A 'decod':96C 'decompress':3A,46B,116C 'default':193C 'dir':30B,72C,183C 'directori':160C 'disabl':191C,203C 'disk':11A,63B,138C 'enabl':27B,69C 'enforc':119C 'enough':53B 'exhaust':8A,56B,166C 'featur':189C 'fill':60B 'first':145C 'fulli':45B 'give':121C 'high':132C 'high-ratio':131C 'host':23B,171C 'http':92C 'impair':174C 'input':108C 'larg':52B 'let':4A 'limit':50B 'materi':146C 'maximum':115C 'memori':9A,58B,134C,172C 'method':93C 'network':74C 'non':126C 'non-superus':125C 'null':185C 'object':151C 'one':111C 'one-shot':110C 'oper':26B,68C 'output':143C 'packag':19B 'pass':104C 'path':211C 'payload':42B,54B,164C 'permiss':37B,79C 'persist':137C 'persistent-disk':136C 'primari':195C 'primit':140C 'product':35B,77C,82C,86C 'python':20B,149C 'ratio':133C 'reli':199C 'report':215C 'scale':163C 'self':22B 'self-host':21B 'send':39B 'server':57B 'ship':178C 'shot':112C 'size':49B,117C 'statist':29B,62B,71C,159C,182C 'store':6A,32B,36B,78C,128C 'store.analysis':28B,70C,181C 'storeanalysisstatist':88C 'string':102C 'suffici':162C 'superus':127C 'take':64B 'thrift':90C 'thrift-over-http':89C 'travers':212C 'unlimit':2A 'valu':179C 'without':47B 'worker':169C 'written':155C 'zlib.decompress':113C","nicknames":[],"mitigations":[],"who_affected":"Only servers where an operator has set store.analysis_statistics_dir to a directory, which is disabled by default (null). The attacker needs a store account with PRODUCT_STORE permission for a product, and no superuser rights. Instances that leave the statistics feature disabled are not affected by this report.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["codechecker","medium","package","python","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-84161':14A,17A 'account':7A 'codecheck':1A 'cve':12A,15A 'decompress':3A 'disk':11A 'exhaust':8A 'let':4A 'memori':9A 'store':6A 'unlimit':2A","search_b":"'account':33B 'codecheck':18B,44B,65B 'compress':41B 'decompress':46B 'dir':30B 'disk':63B 'enabl':27B 'enough':53B 'exhaust':56B 'fill':60B 'fulli':45B 'host':23B 'larg':52B 'limit':50B 'memori':58B 'oper':26B 'packag':19B 'payload':42B,54B 'permiss':37B 'product':35B 'python':20B 'self':22B 'self-host':21B 'send':39B 'server':57B 'size':49B 'statist':29B,62B 'store':32B,36B 'store.analysis':28B 'take':64B 'without':47B","search_c":"'6.29.0':95C 'account':129C 'affect':188C 'amplif':139C 'api':168C 'assess':196C 'attack':99C 'attacker-control':98C 'authent':201C 'author':124C,207C 'avail':176C 'base64':101C 'bypass':208C 'byte':150C 'call':84C 'client':75C 'codecheck':94C,175C 'complet':106C,142C 'compress':107C 'configur':158C 'control':100C 'correct':123C 'decod':96C 'decompress':116C 'default':193C 'dir':72C,183C 'directori':160C 'disabl':191C,203C 'disk':138C 'enabl':69C 'enforc':119C 'exhaust':166C 'featur':189C 'first':145C 'give':121C 'high':132C 'high-ratio':131C 'host':171C 'http':92C 'impair':174C 'input':108C 'materi':146C 'maximum':115C 'memori':134C,172C 'method':93C 'network':74C 'non':126C 'non-superus':125C 'null':185C 'object':151C 'one':111C 'one-shot':110C 'oper':68C 'output':143C 'pass':104C 'path':211C 'payload':164C 'permiss':79C 'persist':137C 'persistent-disk':136C 'primari':195C 'primit':140C 'product':77C,82C,86C 'python':149C 'ratio':133C 'reli':199C 'report':215C 'scale':163C 'ship':178C 'shot':112C 'size':117C 'statist':71C,159C,182C 'store':78C,128C 'store.analysis':70C,181C 'storeanalysisstatist':88C 'string':102C 'suffici':162C 'superus':127C 'thrift':90C 'thrift-over-http':89C 'travers':212C 'valu':179C 'worker':169C 'written':155C 'zlib.decompress':113C","first_public_at":"2026-11-05T16:34:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84161","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84161","severity":null,"published_at":"2026-11-06T11:17:17+00:00","modified_at":"2026-11-06T11:17:17+00:00","first_seen_at":"2026-11-06T11:41:29+00:00","fetched_at":"2026-11-06T11:41:29+00:00","note":null}],"documents":[{"id":85914,"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-05T16:34:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}