Decompression Bomb Detection

When to Use

Audit archive/compression libraries, file upload handlers, content-encoding processors, and any package that decompresses user-supplied data.

Key Insight

Buffer-based decompression is vulnerable: the entire decompressed output is loaded into memory at once. A 1KB compressed payload can expand to 1GB+.

Stream-based MAY have backpressure: but only if the consumer applies it. Many stream implementations still buffer the entire output.

Process

Step 1: Find Decompression Sinks