CVE-2026-18929: Carbone Zip Bomb DOS Vulnerability

CVE-2026-18929 Overview

Carbone, a report and document generation library, is vulnerable to Denial of Service through a zip bomb attack when processing .docx files. The library uses yazl for zip decompression without validating entry sizes. An attacker can submit a crafted .docx file containing compressed data that expands to a significantly larger size on disk or in memory. Decompression exhausts server memory and crashes the application server. The issue is tracked under CWE-409 (Improper Handling of Highly Compressed Data). Maintainers released fixes in Carbone versions 3.8.2, 4.26.3, and 5.4.4.

Critical Impact
Unauthenticated attackers can crash the Carbone application server by uploading a single malicious .docx file, resulting in service unavailability.

Affected Products

Carbone versions prior to 3.8.2 in the 3.x branch
Carbone versions prior to 4.26.3 in the 4.x branch
Carbone versions prior to 5.4.4 in the 5.x branch

Discovery Timeline

2026-08-18 - CVE-2026-18929 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-18929

Vulnerability Analysis

Carbone accepts .docx templates supplied by users and unpacks them as ZIP archives before rendering content. The library relies on yazl for decompression and does not enforce limits on the uncompressed size of individual entries or the total archive. A zip bomb exploits this by packing highly repetitive data that yields a very high compression ratio. When Carbone expands the archive, memory usage grows until the Node.js process aborts. The result is a full crash of the document generation service.

Root Cause

The root cause is the absence of decompression quotas in the .docx ingestion path. Entry size and cumulative output size are never checked against a maximum. This behavior aligns with CWE-409, where an application decompresses attacker-controlled data without bounds. Any endpoint that forwards user templates to Carbone inherits the flaw.

Attack Vector

Exploitation requires the attacker to deliver a malicious .docx file to a Carbone-backed workflow. The attack traverses the network with low complexity and requires no privileges, but does need user or application action to accept the template. Successful delivery causes high availability impact on the target service while leaving confidentiality and integrity unaffected.

javascript

// Security patch excerpt in lib/converter.js
// Source: https://github.com/carboneio/carbone/commit/eb9b4cff992cc1cb1a319d7fc0cbd09160dc214e

// Since LibreOffice 25.2.4.2+, the embedded python cannot be used on Mac
// So we try to find an external python in the user's home directory or in the global directory
function _findPythonFallbackDarwin (sofficePath, pythonName) {
  if (process.platform !== 'darwin') {
    return null;
  }
  const userPath = path.join(process.env.HOME || process.env.USERPROFILE || '', 'libreoffice-python', 'Resources', 'python');
  if (fs.existsSync(userPath)) {
    return userPath;
  }
  const globalPath = '/Applications/libreoffice-python/Resources/python';
  if (fs.existsSync(globalPath)) {
    return globalPath;
  }
  return null;
}

Source: GitHub Carbone Commit Update. The referenced pull request #1174 also revises input path handling in lib/converter.py alongside the zip bomb hardening.

Detection Methods for CVE-2026-18929

Indicators of Compromise

Sudden termination of the Carbone worker process with out-of-memory errors in application logs.
Uploaded .docx files whose compression ratio exceeds normal thresholds, for example an archive smaller than 100 KB expanding to hundreds of megabytes.
Repeated template submission failures from a single source IP or authenticated identity in a short time window.

Detection Strategies

Inspect .docx submissions at an application gateway and calculate the ratio between compressed size and declared uncompressed size in the ZIP central directory.
Correlate Node.js heap out of memory crashes with recent template upload events using centralized logging.
Alert on process restarts of the Carbone service that occur immediately after inbound HTTP requests carrying multipart file uploads.

Monitoring Recommendations

Track resident set size (RSS) and heap usage of the Carbone process and alert on spikes greater than the historical baseline.
Log the size and SHA-256 hash of every submitted template so malicious files can be retrieved for offline analysis.
Monitor upstream reverse proxies for HTTP 502 or 504 responses tied to the Carbone service.

How to Mitigate CVE-2026-18929

Immediate Actions Required

Upgrade Carbone to 3.8.2, 4.26.3, or 5.4.4 depending on the branch currently deployed.
Restrict .docx uploads to authenticated users and enforce a maximum accepted file size at the ingress layer.
Run the Carbone worker under a memory-limited container or systemd unit so a crash cannot exhaust host resources.

Patch Information

The fix is available across all Carbone distribution types. Reference the maintainer commit at GitHub Carbone Commit Update and the CERT Poland CVE-2026-18929 Post for advisory details. Product information is available at the Carbone Official Website.

Workarounds

Pre-scan uploaded .docx files with a ZIP inspector that rejects archives whose entry compression ratio exceeds a safe threshold, for example 1:100.
Isolate the Carbone process in a sandbox with strict cgroup memory limits so a single crash cannot affect neighboring services.
Rate limit template submissions per source identity to reduce repeated exploitation attempts.

bash

# Example: enforce a memory ceiling on the Carbone service via systemd
# Adjust MemoryMax to a value appropriate for your workload
sudo systemctl set-property carbone.service MemoryMax=1G
sudo systemctl set-property carbone.service MemorySwapMax=0
sudo systemctl restart carbone.service

# Verify the limit is in effect
systemctl show carbone.service -p MemoryMax