Denial-of-Service Vulnerability in Pandora's DAA File Handling

CVE-2026-74767

What is CVE-2026-74767?

Pandora experiences a vulnerability in its DAA file handling that can lead to denial-of-service conditions. When processing DAA archives, the application decompresses data chunks without enforcing limits, potentially causing significant memory usage and CPU exhaustion. An attacker can exploit this vulnerability using a specially crafted DAA file, resulting in the extraction worker becoming unresponsive and adversely affecting the availability of the Pandora service. The recent patch addresses this issue by implementing bounded decompression and verifies the size of decompressed chunks, ensuring that excessive data does not overwhelm the system.

References