Unbounded Zlib Decompression Vulnerability in Unfurl by Obsidian Forensics

CVE-2026-40036

What is CVE-2026-40036?

The Unfurl tool developed by Obsidian Forensics is vulnerable due to an unbounded zlib decompression flaw found in parse_compressed.py. This vulnerability allows remote attackers to submit specially crafted, highly compressed payloads through URL parameters to the /json/visjs endpoint. The payloads can expand to gigabytes when processed, potentially exhausting server memory resources and leading to service crashes. It's essential for users of affected versions to apply necessary patches to mitigate these risks and maintain service reliability.

References