CVE-2026-66913: Lookyloo Denial-of-Service Vulnerability

CVE-2026-66913 Overview

CVE-2026-66913 is a denial-of-service vulnerability in Lookyloo, an open-source web capture and analysis tool. The application did not enforce limits on the decompressed size of uploaded capture archives or compressed HAR (HTTP Archive) files. An attacker can submit a specially crafted ZIP, gzip, or zlib payload that expands to a very large size during processing. Because Lookyloo decompressed content directly in memory without bounding the output size, processing the malicious capture can exhaust available memory, terminate web or worker processes, and make the instance unavailable. Repeated exploitation causes a persistent outage until affected processes restart. The weakness is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
A single unauthenticated upload of a zip bomb can exhaust memory and take a Lookyloo instance offline until administrators restart the affected processes.

Affected Products

Lookyloo capture archive import functionality (prior to commit 96589da)
Lookyloo API endpoints accepting gzip-compressed HAR submissions
Lookyloo worker processes handling zlib and gzip decompression of capture data

Discovery Timeline

2026-07-28 - CVE-2026-66913 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66913

Vulnerability Analysis

Lookyloo accepts capture data through two primary paths: full archive imports (ZIP) and API submissions containing gzip-compressed HAR data. Both paths invoked decompression routines that streamed output directly into memory. Neither path validated the cumulative uncompressed size against a ceiling before or during expansion.

An attacker leverages this by submitting a compression bomb. A small ZIP, gzip, or zlib payload of a few megabytes can decompress to many gigabytes of data. The Python runtime attempts to materialize the full decompressed buffer, driving resident memory beyond available limits. The kernel OOM killer terminates the affected worker, or the process crashes with MemoryError, leaving the instance in a degraded or unavailable state.

Root Cause

The root cause is missing output-size enforcement during decompression. The affected helpers in lookyloo/helpers.py invoked zlib and gzip decompression without a maximum-length parameter, and archive extraction did not track the running total of uncompressed bytes across entries. There was no dedicated exception type for detecting oversized archives, so callers could not distinguish a zip bomb from a legitimate large capture.

Attack Vector

Exploitation requires network access and user interaction to submit a capture. Authentication is not required on instances that expose public capture submission. An attacker crafts a compression bomb and submits it either as a capture archive import or through the API HAR endpoint. The vulnerability affects only availability; it does not disclose or modify data.

python

# Patch excerpt: new dedicated exception for oversized archives
# Source: https://github.com/Lookyloo/lookyloo/commit/96589da290f018e356db7c0eaddf1aa501630ca7
 class TreeBuildFailed(LookylooException):
     """Building the tree failed"""
     pass
+
+
+class ZipBomb(LookylooException):
+    """The archived file file is too big and probably a zip bomb"""
+    pass

python

# Patch excerpt: zlib import added to helpers for size-limited decompression
# Source: https://github.com/Lookyloo/lookyloo/commit/96589da290f018e356db7c0eaddf1aa501630ca7
 import re
 import secrets
 import time
+import zlib

 from datetime import datetime, timedelta, date
 from functools import lru_cache, cache

Detection Methods for CVE-2026-66913

Indicators of Compromise

Sudden MemoryError exceptions or OOM-killer entries in dmesg correlated with Lookyloo worker process IDs.
Repeated HTTP 5xx responses from the Lookyloo capture import or HAR API endpoints following small upload requests.
Uploaded ZIP or gzip files with a very high compression ratio (for example, under 10 MB compressed expanding to gigabytes).

Detection Strategies

Inspect application logs for the new ZipBomb exception class introduced in commit 96589da to identify blocked exploitation attempts on patched instances.
Monitor process memory consumption for Lookyloo web and worker processes and alert on rapid growth exceeding normal baselines.
Add reverse-proxy logging on POST endpoints that accept capture archives and compressed HAR data, capturing content length and source IP.

Monitoring Recommendations

Track resident memory and swap usage per Lookyloo worker via node-level metrics collection.
Alert on HTTP 400 responses from the compressed HAR API endpoint after patching, since these indicate rejected oversized submissions worth reviewing.
Correlate capture submission source IPs with repeated worker restarts to surface persistent DoS attempts.

How to Mitigate CVE-2026-66913

Immediate Actions Required

Update Lookyloo to a version containing commit 96589da290f018e356db7c0eaddf1aa501630ca7 or later.
Restart Lookyloo web and worker processes after applying the patch to clear any pending exhausted state.
Restrict access to capture submission endpoints behind authentication or an IP allowlist where operationally feasible.

Patch Information

The upstream fix is available in the Lookyloo GitHub commit 96589da. The patch introduces a 1 GB cumulative uncompressed-size limit for imported capture archives, adds size-limited gzip and zlib decompression for compressed HAR files, defines a dedicated ZipBomb exception for suspected compression bombs, and returns HTTP 400 when an oversized compressed HAR file is submitted through the API.

Workarounds

Place Lookyloo behind a reverse proxy that enforces a strict client_max_body_size on capture upload routes to limit compressed input size.
Apply Linux cgroup memory limits (for example, via systemd unit MemoryMax=) to Lookyloo worker processes so that a zip bomb terminates a single worker rather than the host.
Disable public capture submission until the patched build is deployed if the instance is internet-facing.

bash

# Example systemd override to cap Lookyloo worker memory
sudo systemctl edit lookyloo.service
# In the editor, add:
# [Service]
# MemoryMax=2G
# MemorySwapMax=0
sudo systemctl daemon-reload
sudo systemctl restart lookyloo.service