CVE-2026-58107 Overview
CVE-2026-58107 affects CodeChecker, an open-source static analysis result management tool maintained by Ericsson. The massStoreRun processing path performs one-shot decompression of Base64-encoded zlib data supplied by authenticated clients. The server does not enforce a maximum decompressed size before materializing the output in memory.
An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. The full decompressed buffer is held in memory before being written to a temporary file, allowing memory and disk exhaustion. The weakness is classified as [CWE-409] Improper Handling of Highly Compressed Data (Data Amplification).
Critical Impact
Authenticated users can trigger memory and disk exhaustion on the CodeChecker server through zip-bomb style payloads, resulting in denial of service for all users of the analysis store.
Affected Products
- Ericsson CodeChecker (server component processing massStoreRun requests)
- Deployments accepting Base64-encoded zlib analysis payloads from authenticated users
- Multi-tenant CodeChecker instances where store permissions are broadly granted
Discovery Timeline
- 2026-08-28 - CVE-2026-58107 published to the National Vulnerability Database
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-58107
Vulnerability Analysis
CodeChecker exposes a massStoreRun API endpoint used to upload analysis results for storage and later review. Clients submit results as Base64-encoded zlib-compressed blobs. The server decodes and decompresses the payload in a single pass, buffering the entire decompressed output in process memory before writing it to a temporary file on disk.
The decompression routine does not enforce an upper bound on the output size. It also does not stream the data through a size-checked reader. An attacker who can authenticate and store runs can craft a small compressed payload that expands by several orders of magnitude, a classic data amplification pattern tracked as [CWE-409].
Because the payload materializes in memory first, a single request can drive the CodeChecker process toward its resident memory limit. Subsequent writes to the temporary file compound the impact by consuming disk space on the storage volume.
Root Cause
The root cause is the absence of a decompressed-size ceiling in the ingestion path. The code accepts the compressed input as attacker-controlled but treats the decompressed output as trusted for sizing purposes. Neither the in-memory buffer nor the temporary file writer applies a byte cap or an incremental limit.
Attack Vector
Exploitation requires network access to the CodeChecker API and an authenticated account with permission to store analysis runs. The attacker generates a compressed zlib blob whose decompressed size is many multiples of its compressed size. The blob is Base64-encoded and submitted through a normal massStoreRun request. The server attempts full decompression, exhausts available memory, and can no longer serve other users. Refer to the GitHub Security Advisory GHSA-w7jw-x567-hqr4 for the maintainer's technical description.
Detection Methods for CVE-2026-58107
Indicators of Compromise
- Sudden growth in CodeChecker server resident memory followed by an out-of-memory kill or process restart.
- Rapid consumption of free space on the temporary file directory or storage volume used by the CodeChecker server.
- massStoreRun requests originating from a single authenticated account with anomalously small request bodies relative to their processing impact.
- Server-side latency spikes or 5xx responses correlated with a specific authenticated principal.
Detection Strategies
- Log request size, decompressed size, and duration for each massStoreRun invocation and alert on high amplification ratios.
- Correlate authenticated user identifiers with resource metrics to identify accounts driving disproportionate consumption.
- Baseline normal analysis payload sizes per project and flag statistical outliers.
Monitoring Recommendations
- Monitor process memory, swap use, and temporary directory disk usage on CodeChecker hosts.
- Track HTTP 5xx rates and out-of-memory events in service logs.
- Retain authentication and API access logs long enough to attribute resource spikes to specific users.
How to Mitigate CVE-2026-58107
Immediate Actions Required
- Upgrade CodeChecker to the fixed release identified in the GitHub Security Advisory GHSA-w7jw-x567-hqr4.
- Review who holds the store-run permission and revoke it from accounts that do not require it.
- Place the CodeChecker server behind a reverse proxy that enforces request body size limits.
Patch Information
Ericsson has published a security advisory for CVE-2026-58107 at GHSA-w7jw-x567-hqr4. Apply the fixed version referenced in that advisory. The fix introduces a bounded, streaming decompression path that enforces a maximum decompressed size before the payload is written to disk.
Workarounds
- Restrict massStoreRun access to trusted service accounts and CI systems only.
- Enforce upstream body-size limits on the reverse proxy or API gateway fronting CodeChecker.
- Isolate the CodeChecker process with cgroup memory limits and a dedicated temporary storage volume so exhaustion cannot cascade to other services.
- Rate-limit store operations per authenticated identity to bound the impact of a single abusive client.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.