Which versions of Dfir Unfurl are affected by CVE-2026-40036?

dfir-unfurl versions through 20250810 contain a critical memory exhaustion vulnerability in the /json/visjs endpoint that allows unauthenticated attackers to crash the service by submitting specially…. A patch is available.

How to fix or mitigate CVE-2026-40036?

Within 24 hours: Disable or restrict network access to the /json/visjs endpoint on all dfir-unfurl instances; document affected systems and their criticality. Within 7 days: Implement input validation and decompression size limits at the application or WAF level; monitor for unusual compressed payload submissions. Within 30 days: Upgrade to dfir-unfurl version 20250811 or later once vendor releases patched version; verify all instances are updated and re-enable the endpoint after confirming patches.

Dfir Unfurl CVE-2026-40036

Q: What is the CVSS score of CVE-2026-40036?

CVE-2026-40036 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-20779 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-04-08 VulnCheck

GHSA-c3f2-qg8v-25q2

GHSA-h5qv-qjv4-pc5m

Denial Of Service Dfir Unfurl

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 16:07 vuln.today

cvss_changed

Patch released

Apr 10, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20779

Analysis Generated

Apr 08, 2026 - 22:01 vuln.today

CVE Published

Apr 08, 2026 - 21:35 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on dfir-unfurl (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 20260405.

DescriptionCVE.org

dfir-unfurl through 20250810 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service. Attackers can submit highly compressed payloads via URL parameters to the /json/visjs endpoint that expand to gigabytes, exhausting server memory and crashing the service.

AnalysisAI

Unbounded zlib decompression in dfir-unfurl versions through 20250810 enables unauthenticated remote attackers to exhaust server memory via crafted compressed payloads submitted to the /json/visjs endpoint. Attackers can submit highly compressed data that expands to gigabytes when decompressed, crashing the service through resource exhaustion. The vulnerability affects the parse_compressed.py module and requires no authentication. No public exploit identified at time of analysis.

Technical ContextAI

Root cause resides in parse_compressed.py where zlib decompression operations lack size limits or resource bounds (CWE-400). The /json/visjs endpoint accepts URL parameters containing compressed data without validating expansion ratios, enabling zip bomb-style attacks. CPE: cpe:2.3:a:dfir-unfurl:dfir-unfurl applies to all versions through 20250810.

RemediationAI

Vendor-released patch: v2026.04 available at https://github.com/obsidianforensics/unfurl/releases/tag/v2026.04. Upgrade dfir-unfurl installations to version v2026.04 or later immediately. Until patching is complete, implement network-layer rate limiting and request size restrictions on the /json/visjs endpoint to mitigate decompression bomb attacks. Monitor server memory utilization for abnormal spikes. Review vendor security advisory at https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m for additional deployment guidance. VulnCheck analysis available at https://www.vulncheck.com/advisories/dfir-unfurl-denial-of-service-via-unbounded-zlib-decompression provides exploitation context.