THREAT OPS › Threat News › [GHSA] GHSA-x768-8642-mmq9 (medium) — MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
[GHSA] GHSA-x768-8642-mmq9 (medium) — MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
GHSA-x768-8642-mmq9 Severity: medium CVE: CVE-2026-68924
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
### Summary
When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed `ZIP_MAX_UNCOMPRESSED_FILE_SIZE` (400 MB) and logs "Skipping" — but the code lacks a `continue` statement, so extraction proceeds anyway. The log me
Indicators of compromise
- CVE-2026-68924cve
- http://127.0.0.1:8000/api/v1/uploadurl
Original source: https://github.com/advisories/GHSA-x768-8642-mmq9