CVE-2026-40036

HIGH 7.5

Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression

CVSS Score

7.5

EPSS Score

0.1%

EPSS Percentile

28th

Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.

CWE	CWE-770 CWE-409
Vendor	obsidianforensics
Product	unfurl
Published	Apr 8, 2026
Last Updated	Apr 11, 2026

Stay Ahead of the Next One

Get instant alerts for obsidianforensics unfurl

Be the first to know when new high vulnerabilities affecting obsidianforensics unfurl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

obsidianforensics / unfurl

0 < 2026.04

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m github.com: https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04 vulncheck.com: https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression

Credits

🔍 Mobasi Security Team