decompression-bomb

Warn

Audited by Socket on May 12, 2026

1 alert found:

Security
SecurityMEDIUM
references/poc-skeleton.md

This fragment is a decompression-bomb PoC skeleton designed to stress-test (or potentially abuse) a decompression API by supplying highly compressible gzip/zip inputs intended to expand dramatically. The primary risk is denial-of-service via uncontrolled memory growth (OOM/SIGABRT). There is no evidence in this snippet of data theft or remote compromise; however, if such code were used against or integrated into environments without strict decompression limits, it could be harmful for availability.

Confidence: 74%Severity: 70%
Audit Metadata
Analyzed At
May 12, 2026, 05:09 PM
Package URL
pkg:socket/skills-sh/ByamB4%2Ffind-cve-agent%2Fdecompression-bomb%2F@b5e28cae42f0dab2a8e0227dc1e519d3b31bfad4
Security Audit — socket — decompression-bomb