Is there a patch available for CVE-2026-66913?

Yes, a patch is available for CVE-2026-66913. Update the affected software to the latest version immediately.

Lookyloo CVE-2026-66913

Q: What is the CVSS score of CVE-2026-66913?

CVE-2026-66913 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-49768 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-28 CIRCL

Denial Of Service Lookyloo

6.9

CVSS 4.0 · Vendor: CIRCL

Severity by source

Vendor (CIRCL) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CIRCL) · only source for this CVE.

CVSS VectorVendor: CIRCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 28, 2026 - 12:51 vuln.today

Analysis Generated

Jul 28, 2026 - 12:51 vuln.today

DescriptionCVE.org

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.

An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.

The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.

The patch introduces:

A 1 GB cumulative uncompressed-size limit for imported capture archives.
Size-limited gzip and zlib decompression for compressed HAR files.
Explicit detection and handling of suspected zip bombs.
An HTTP 400 response when an oversized compressed HAR file is submitted through the API.

AnalysisAI

We need to produce a JSON object with the specified fields. The input provides CVE-2026-66913 details, multi-source intelligence including patch availability, CPE, SSVC, EPSS not explicitly given (but EPSS is mentioned in the prompt; we don't have an EPSS score in the data). The prompt says "Use ALL the data provided — including references, EPSS, KEV status, patch availability, CPE strings, and tags". There's no EPSS score in the provided data. No KEV status. The SSVC data: Exploitation: none, Automatable: no, Technical Impact: partial. We have a patch available, commit link, the CWE-400 (Uncontrolled Resource Consumption). CVSS 4.0 vector provided.

Key fields:

product_name: "Lookyloo" (2 words? "Lookyloo" is 1 word but I'll just say "Lookyloo"). It's an open source web-based tool for HTTP traffic analysis. So "Lookyloo".
summary: Must be original synthesis. Not copy description. The vulnerability is a denial-of-service via unbounded decompression of uploaded capture archives and compressed HAR files in Lookyloo. Affects versions up to 1.40.0. Attackers can submit a specially crafted ZIP, gzip, or zlib-compressed capture data that expands to a very large size in memory, causing memory exhaustion, process termination, and potential instance unavailability. Patch introduced 1 GB cumulative size limit and safe decompression. No active exploitation, no POC mentioned. EPSS not provided. So summary: "Memory exhaustion denial of service in Lookyloo versions ≤1.40.0 via crafted compressed uploads allows unauthenticated attackers to exhaust memory and crash the service." Check CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A... UI:A means user interaction required? Actually UI:A means Active? CVSS 4.0: UI (User Interaction) can be None (N), Required (R), or Active (A). UI:A means "Active interaction with the vulnerable component is required to exploit the vulnerability." That's unusual for a server-side attack. Typically for DoS, if an attacker can just send a compressed file,