EUVD-2026-63097
GHSA-r89f-h4hf-p5h7
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Network submission of compressed artifacts requires authenticated low-privilege access and precise payload crafting; only availability is impacted, not confidentiality or integrity.
Primary rating from Vendor (3938794e-25f5-4123-a1ba-5cbd7f104512).
CVSS VectorVendor: 3938794e-25f5-4123-a1ba-5cbd7f104512
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Tanium addressed a compression bomb vulnerability in Threat Response.
AnalysisAI
Tanium Threat Response is affected by a compression bomb (zip bomb) vulnerability tracked as CWE-409, allowing an authenticated network attacker to submit a specially crafted highly-compressed file that expands during processing and exhausts host resources. The impact is limited to availability - confidentiality and integrity are unaffected per the CVSS vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privilege authenticated session within the Tanium platform (PR:L per CVSS), meaning the attacker must already hold valid Tanium credentials or control a managed endpoint capable of submitting artifacts to Threat Response. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall real-world risk is low-to-moderate for most enterprise deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user or a compromised managed endpoint submits a specially crafted compression bomb - a small archive that decompresses to an extremely large volume of data - to the Tanium Threat Response module. The module, lacking decompression ratio enforcement, expands the payload and exhausts available memory or CPU on the processing host, causing degraded responsiveness or a partial service disruption. … |
| Remediation | Apply the vendor-issued patch addressed in Tanium Security Advisory TAN-2026-021, available at https://security.tanium.com/TAN-2026-021. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today