CVE-2026-3816: OWASP DefectDojo DOS Vulnerability

CVE-2026-3816 Overview

A denial of service vulnerability has been identified in OWASP DefectDojo versions up to 2.55.4. This security flaw affects the input_zip.read function within the parser.py file, specifically impacting the SonarQubeParser and MSDefenderParser components. An authenticated attacker can exploit this vulnerability remotely by uploading a specially crafted zip file (commonly known as a "zip bomb"), leading to resource exhaustion and denial of service conditions on the affected system.

Critical Impact

Remote authenticated attackers can cause denial of service through zip bomb attacks, potentially disrupting security scanning operations and vulnerability management workflows within DefectDojo deployments.

Affected Products

• OWASP DefectDojo versions up to and including 2.55.4
• DefectDojo SonarQubeParser component
• DefectDojo MSDefenderParser component

Discovery Timeline

• 2026-03-09 - CVE-2026-3816 published to NVD
• 2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-3816

Vulnerability Analysis

This vulnerability (CWE-404: Improper Resource Shutdown or Release, CWE-1284: Improper Validation of Specified Quantity in Input) stems from insufficient validation when processing zip file contents in DefectDojo's parser components. When a user uploads a maliciously crafted zip file through the SonarQubeParser or MSDefenderParser, the application fails to properly validate the decompressed file size before reading the contents into memory.

The input_zip.read function processes the uploaded archive without implementing adequate safeguards against decompression bombs. This allows an attacker to craft a small compressed file that expands to an extremely large size when decompressed, exhausting available memory resources (OOM - Out of Memory) and causing the application to become unresponsive.

Root Cause

The root cause of this vulnerability lies in improper validation of input quantities within the zip file handling logic. The affected parser components do not enforce limits on the decompressed size of uploaded archives, allowing zip bombs to consume excessive system resources. The parser.py file processes zip contents without checking compression ratios or implementing size thresholds, enabling resource exhaustion attacks.

Attack Vector

An authenticated attacker with access to DefectDojo's file upload functionality can exploit this vulnerability by uploading a specially crafted zip bomb through the SonarQube or Microsoft Defender import features. The attack is network-accessible and requires low privileges (authenticated user access).

The exploitation process involves:

1. Creating a zip bomb file with an extreme compression ratio (small compressed size, massive decompressed size)
2. Uploading the malicious zip file through DefectDojo's parser import functionality
3. The input_zip.read function attempts to decompress and process the file contents
4. System memory becomes exhausted, causing denial of service

Detailed analysis of the zip bomb DoS vulnerability is available in the security researcher's writeup.

Detection Methods for CVE-2026-3816

Indicators of Compromise

• Abnormal memory consumption spikes when processing zip file imports in DefectDojo
• Application crashes or out-of-memory errors during SonarQube or MS Defender import operations
• Unusually small zip files uploaded through the import functionality with suspicious compression ratios
• System resource exhaustion events correlated with DefectDojo parser activity

Detection Strategies

• Monitor DefectDojo application logs for OOM (Out of Memory) errors during import operations
• Implement file upload analysis to detect zip files with abnormally high compression ratios
• Configure alerting for sudden memory consumption increases in DefectDojo containers or processes
• Review upload logs for repeated attempts to upload small zip files followed by system instability

Monitoring Recommendations

• Enable resource monitoring on DefectDojo deployments to track memory utilization patterns
• Implement application performance monitoring (APM) to detect anomalous parser behavior
• Set up automated alerts for process crashes or restarts in DefectDojo services
• Monitor network traffic for unusual upload patterns to the import endpoints

How to Mitigate CVE-2026-3816

Immediate Actions Required

• Upgrade OWASP DefectDojo to version 2.56.0 or later immediately
• Review DefectDojo access controls to ensure only trusted users have import permissions
• Consider temporarily disabling SonarQube and MS Defender import functionality until patched
• Implement resource limits (memory caps) on DefectDojo containers or processes as a defense-in-depth measure

Patch Information

OWASP has released version 2.56.0 to address this vulnerability. The fix is identified by commit hash e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Organizations should upgrade to the patched version by following the official release notes.

The patch details can be reviewed in the GitHub commit and pull request #14408.

Workarounds

• Restrict access to DefectDojo import functionality to trusted administrators only
• Implement network-level controls to limit who can access the import endpoints
• Configure container or process memory limits to prevent complete system resource exhaustion
• Deploy a web application firewall (WAF) rule to inspect and limit uploaded zip file sizes

# Example: Restricting DefectDojo container memory to prevent complete system exhaustion
docker run -d \
  --name defectdojo \
  --memory="4g" \
  --memory-swap="4g" \
  defectdojo/defectdojo:latest