Memory and Disk Amplification Vulnerability in CodeChecker by Ericsson
CVE-2026-84161

4.9MEDIUM

Key Information:

Vendor

Ericsson

Status
Codechecker
Vendor
CVE Published:
6 November 2026

What is CVE-2026-84161?

A vulnerability exists in CodeChecker that allows an authorized user with PRODUCT_STORE permission to exploit the storeAnalysisStatistics Thrift-over-HTTP method. When set to enable store.analysis_statistics_dir, this feature allows the processing of an attacker-controlled Base64 string, which is then decompressed without proper size constraints. This presents a risk of memory and persistent-disk amplification, potentially leading to exhaustion of API worker or host memory and compromising service availability. While this feature is disabled by default, the risk remains if enabled inadvertently, highlighting the importance of secure configurations.

Affected Version(s)

CodeChecker 0 < 6.29.3

References

https://github.com/Ericsson/codechecker/security/advisori...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hatae@fsec.or.kr / FSI RED IRIS Team
.