---
id: "CVE-2026-84161"
page: "https://infrastack.ai/live/CVE-2026-84161"
kind: "vulnerability"
aliases: ["CVE-2026-84161"]
title: "CodeChecker: unlimited decompression lets a store account exhaust memory and disk"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["codechecker", "package", "python", "self-hosted"]
not_affected_if: ["default-config", "no-product-store-accounts"]
published_at: "2026-11-06T11:17:17+00:00"
first_seen_at: "2026-11-06T11:41:29+00:00"
updated_at: "2026-11-06T11:42:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84161", "first_seen_at": "2026-11-06T11:41:29+00:00"}]
exploit_sources: []
---

# CodeChecker: unlimited decompression lets a store account exhaust memory and disk

Link for people: https://infrastack.ai/live/CVE-2026-84161 (this .md is for agents)

When an operator enables store.analysis_statistics_dir, a store account with PRODUCT_STORE permission can send a compressed payload that CodeChecker fully decompresses without any size limit. A large enough payload can exhaust server memory and fill the statistics disk, taking CodeChecker down.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `store.analysis_statistics_dir` in the CodeChecker server configuration and confirm it is set to a path rather than null.
- Check the CodeChecker version in use; the sources name `6.29.0` as affected.

## Timeline

- 2026-11-06T11:41:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84161

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv

## From the sources

When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced.



This gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability.



The shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_