CVE-2026-22870: GuardDog CLI Zip Bomb DoS Vulnerability

CVE-2026-22870 Overview

GuardDog is a CLI tool developed by DataDog to identify malicious PyPI packages. A vulnerability exists in versions prior to 2.7.1 where the safe_extract() function fails to validate decompressed file sizes when extracting ZIP archives (wheels, eggs). This flaw allows attackers to cause denial of service through zip bombs, where a malicious package can consume gigabytes of disk space from only a few megabytes of compressed data.

Critical Impact

Attackers can exploit this vulnerability to exhaust disk resources on systems running vulnerable versions of GuardDog, potentially disrupting security scanning operations and CI/CD pipelines that rely on the tool for malicious package detection.

Affected Products

• GuardDog versions prior to 2.7.1
• Systems processing untrusted PyPI packages (wheels, eggs) with GuardDog
• CI/CD pipelines using GuardDog for package security scanning

Discovery Timeline

• 2026-01-13 - CVE CVE-2026-22870 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22870

Vulnerability Analysis

This vulnerability (CWE-409: Improper Handling of Highly Compressed Data) exists because the safe_extract() function in GuardDog does not implement proper validation of decompressed file sizes during ZIP archive extraction. When processing wheel (.whl) or egg (.egg) Python package formats, the function extracts contents without checking the compression ratio or final decompressed size against reasonable limits.

This design flaw enables a class of attacks known as "zip bombs" or "decompression bombs," where specially crafted archives contain highly compressed data that expands to enormous sizes when extracted. A malicious actor could craft a Python package that appears small (a few megabytes) but decompresses to gigabytes of data, rapidly consuming available disk space.

Root Cause

The root cause stems from insufficient input validation in the archive extraction logic. The safe_extract() function was designed to handle potentially malicious archives but did not account for the compression ratio attack vector. Without checking the expected decompressed size against configurable limits or monitoring cumulative extracted data size, the function becomes vulnerable to resource exhaustion attacks.

Attack Vector

The attack requires network access where an attacker publishes a maliciously crafted Python package to a repository or tricks a user into scanning a local malicious archive. User interaction is required as the victim must run GuardDog against the malicious package. Once triggered, the extraction process consumes disk space without bounds until storage is exhausted or the process is terminated.

The attack flow involves:

1. Attacker creates a zip bomb disguised as a legitimate Python wheel or egg package
2. Victim downloads or encounters the malicious package
3. GuardDog's safe_extract() function processes the archive
4. Decompression expands the archive far beyond expected sizes
5. Disk space is exhausted, causing denial of service

Detection Methods for CVE-2026-22870

Indicators of Compromise

• Unexpected rapid disk space consumption during GuardDog execution
• GuardDog processes consuming unusually high I/O resources
• Large temporary files or directories created during package extraction
• System alerts for low disk space triggered during security scanning operations

Detection Strategies

• Monitor disk I/O and space utilization during GuardDog execution for anomalous patterns
• Implement alerting on GuardDog processes that run longer than expected timeframes
• Review package sizes before and after extraction for unusual compression ratios
• Audit CI/CD pipeline logs for extraction failures or resource exhaustion errors

Monitoring Recommendations

• Configure disk space monitoring with thresholds appropriate for your environment
• Implement process resource limits (cgroups, ulimit) on systems running GuardDog
• Log and alert on extraction operations that exceed predefined size thresholds
• Monitor system stability during automated package scanning workflows

How to Mitigate CVE-2026-22870

Immediate Actions Required

• Upgrade GuardDog to version 2.7.1 or later immediately
• Review recent GuardDog executions for signs of resource exhaustion
• Audit packages processed by vulnerable GuardDog versions for potential malicious content
• Implement resource limits on systems running GuardDog as defense-in-depth

Patch Information

The vulnerability is fixed in GuardDog version 2.7.1. The fix implements proper validation of decompressed file sizes during ZIP archive extraction. For technical details about the patch, refer to the GitHub commit c3fb07b4838945f42497e78b7a02bcfb1e63969b. Additional information is available in the GitHub Security Advisory GHSA-ffj4-jq7m-9g6v.

Workarounds

• Run GuardDog in isolated environments with strict disk quotas until patching is complete
• Implement container-based execution with resource constraints (memory and disk limits)
• Pre-screen packages for suspicious compression ratios before GuardDog analysis
• Monitor and terminate GuardDog processes that exceed expected execution time or disk usage

# Configuration example - Run GuardDog with disk quota in containerized environment
# Example using Docker with tmpfs size limit
docker run --rm -v /path/to/packages:/scan:ro \
  --tmpfs /tmp:size=500m \
  guarddog-image:2.7.1 guarddog pypi scan /scan/package.whl