PT-2026-31471 · Unfurl · Unfurl

Mobasi-Team · Published 2026-01-29 · Updated 2026-04-09 · CVE-2026-40036

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Unfurl versions prior to 2026.04

Description Unfurl contains a flaw in the parse compressed.py component due to unbounded zlib decompression. Remote attackers can leverage this to cause a denial of service. Specifically, attackers can send large, compressed payloads through URL parameters to the /json/visjs API endpoint. These payloads expand to gigabytes, consuming server memory and leading to service crashes.

Recommendations Update to version 2026.04 or later.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-409

CWE-770

CWE-400

Related Identifiers

CVE-2026-40036

GHSA-C3F2-QG8V-25Q2

GHSA-H5QV-QJV4-PC5M

Affected Products

Unfurl

References · 12

• https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m · Vendor Advisory
• https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04 · Patch
• https://osv.dev/vulnerability/GHSA-c3f2-qg8v-25q2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5qv-qjv4-pc5m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40036 · Security Note
• https://github.com/RyanDFIR/unfurl · Note
• https://github.com/RyanDFIR/unfurl/pull/243 · Note
• https://github.com/RyanDFIR/unfurl/commit/7cc711a65b106742a21080b755f81c17b5725aa8 · Note
• https://github.com/RyanDFIR/unfurl/releases/tag/v2026.04 · Note
• https://github.com/obsidianforensics/unfurl · Note
• https://twitter.com/CveFindCom/status/2042101127420788970 · Twitter Post
• https://vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression · Note