PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40036 obsidianforensics CVE debrief

Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service. This vulnerability is particularly concerning for users who expose Unfurl to untrusted networks or allow untrusted input. The CVSS score for this vulnerability is 8.7, indicating a high severity.

Vendor
obsidianforensics
Product
unfurl
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-14
Advisory published
2026-04-08
Advisory updated
2026-07-14

Who should care

Users of Unfurl before version 2026.04 should apply the patch to prevent denial of service attacks. This vulnerability is particularly concerning for users who expose Unfurl to untrusted networks or allow untrusted input. Operators, administrators, and security teams should review the vulnerability details and take necessary actions to protect their systems.

Technical summary

The vulnerability exists in the parse_compressed.py file of Unfurl before 2026.04. An attacker can exploit this vulnerability by submitting highly compressed payloads via URL parameters to the /json/visjs endpoint, causing the server to run out of memory and crash. The CVSS score for this vulnerability is 8.7, indicating a high severity. Users of Unfurl should be cautious when exposing the service to untrusted networks or allowing untrusted input.

Defensive priority

High

Recommended defensive actions

  • Apply the patch to upgrade Unfurl to version 2026.04 or later
  • Restrict access to the /json/visjs endpoint to trusted sources
  • Monitor server memory usage and implement limits on input size
  • Consider implementing a web application firewall to detect and prevent similar attacks
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:24.190Z and was last modified on 2026-07-14T21:16:47.817Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and may not reflect the full scope of the vulnerability. Users should verify the details with the official CVE record and NVD entry for the most accurate and up-to-date information.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T22:16:24.190Z and has not been modified since then. The NVD entry is currently Analyzed.