CVE-2026-11617: Tanium Findings DOS Vulnerability

CVE-2026-11617 Overview

CVE-2026-11617 is a compression bomb vulnerability in the Tanium Findings component. Tanium published Security Advisory TAN-2026-020 to address the issue. The flaw is classified under [CWE-409] (Improper Handling of Highly Compressed Data). An authenticated attacker on the network can submit a crafted compressed payload that consumes disproportionate resources when decompressed, resulting in limited availability impact on the service.

Critical Impact
Successful exploitation degrades the availability of the Findings component through resource exhaustion when the application decompresses attacker-supplied data.

Affected Products

Tanium Findings (see vendor advisory TAN-2026-020 for affected versions)

Discovery Timeline

2026-08-19 - CVE-2026-11617 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-11617

Vulnerability Analysis

The vulnerability resides in how Tanium Findings processes compressed input. An attacker submits a small compressed archive that expands to a disproportionately large size during decompression. This behavior falls under [CWE-409], improper handling of highly compressed data, commonly referred to as a compression bomb or zip bomb. The result is excess memory, disk, or CPU consumption within the Findings component. The advisory scopes the impact to availability only, with no effect on confidentiality or integrity.

Root Cause

The Findings component decompresses attacker-influenced data without enforcing sufficient limits on the decompressed size, expansion ratio, or resource consumption. Without these guardrails, a compact input can produce output orders of magnitude larger. Tanium remediated the issue in the version referenced by advisory TAN-2026-020.

Attack Vector

Exploitation requires network access and low-privileged authentication to the Findings interface accepting compressed content. The attacker uploads or submits a crafted compressed payload. Attack complexity is high because the attacker must produce input that triggers the resource condition against the specific decompression path. There is no user interaction requirement, and no public proof-of-concept has been observed.

No verified exploit code is publicly available. Refer to the Tanium Security Advisory TAN-2026-020 for authoritative technical details.

Detection Methods for CVE-2026-11617

Indicators of Compromise

Sudden memory or CPU spikes in the Tanium Findings service process without a corresponding workload change.
Uploads or API submissions containing archives with abnormally high compression ratios (for example, output-to-input ratios exceeding 1000:1).
Repeated failed or truncated decompression operations logged by the Findings component.

Detection Strategies

Inspect application and system logs for out-of-memory events, thread pool exhaustion, or restarts of the Findings service tied to upload activity.
Correlate authenticated user sessions submitting compressed content with resource consumption metrics on the host.
Alert on inbound archives whose declared or observed decompressed size exceeds a defined threshold.

Monitoring Recommendations

Track process-level memory and CPU utilization on Tanium servers hosting Findings and baseline normal ranges.
Enable and forward Tanium audit logs to a centralized log platform for correlation with host telemetry.
Monitor authentication events for the Findings component and flag accounts submitting anomalously compressed payloads.

How to Mitigate CVE-2026-11617

Immediate Actions Required

Apply the fixed version identified in Tanium Security Advisory TAN-2026-020.
Restrict Findings access to trusted, authenticated users following the principle of least privilege.
Review account permissions and revoke unnecessary access to interfaces that accept compressed uploads.

Patch Information

Tanium has released a fix through advisory TAN-2026-020. Administrators should consult the advisory for exact affected and fixed version numbers, then upgrade the Tanium Findings module during the next available maintenance window.

Workarounds

Limit the maximum size of compressed uploads accepted by Findings at the network or proxy layer until patching is complete.
Enforce rate limiting and quotas on authenticated users interacting with the Findings API.
Monitor and alert on resource consumption thresholds for the Findings service so operators can intervene before availability is affected.

bash

# Configuration example
# Refer to Tanium Security Advisory TAN-2026-020 for vendor-supplied
# upgrade steps and any configuration guidance for the Findings module.
# https://security.tanium.com/TAN-2026-020