CVE-2026-66913

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable. The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted. The patch introduces: * A 1 GB cumulative uncompressed-size limit for imported capture archives. * Size-limited gzip and zlib decompression for compressed HAR files. * Explicit detection and handling of suspected zip bombs. * An HTTP 400 response when an oversized compressed HAR file is submitted through the API.

• CWE-400

• https://github.com/Lookyloo/lookyloo/commit/96589da290f018e356db7c0eaddf1aa501630ca7

Published

Jul 28, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6689Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.1…4.3
• CVE-2026-6690The LifePress plugin for WordPress is vulnerable to Stored C…7.2
• CVE-2026-66901Google::Auth versions before 0.09 for Perl allow server side…7.5
• CVE-2026-66902Google::Auth versions before 0.06 for Perl run a command nam…9.8
• CVE-2026-66909Apache CXF's JMS transport deserializes the body of any inbo…9.8
• CVE-2026-6691The MongoDB C Driver's Cyrus SASL integration performs unsaf…8.6
• CVE-2026-66914Joomla Extension - seblod.com - Unauthenticated path travers…9.2
• CVE-2026-66915Joomla Extension - fabrikar.com - Remote code execution in F…10
• CVE-2026-66918Pivotick fails to sanitize attacker-controlled SVG markup su…8.2
• CVE-2026-66919Pivotick contains a cross-site scripting vulnerability in th…6.9
• CVE-2026-6692The Slider Revolution plugin for WordPress is vulnerable to …8.8
• CVE-2026-66920Pivotick contains an uncontrolled-recursion vulnerability wh…8.2