Eclipse Openvsx
Monthly
Disk exhaustion via zip bomb in Eclipse OpenVSX allows a publisher to cause persistent service disruption on any OpenVSX server instance. A publisher uploads a small, highly compressed VSIX (zip bomb) that the server decompresses without size limits when any client requests a file via /vscode/unpkg/; the decompressed content is cached to java.io.tmpdir under an entry-count eviction policy with no total-size bound, enabling repeated disk exhaustion through new filenames or versions. Impact includes HTTP 500 errors for all uncached resources, publishing failures with 'Failed to read extension file', and a poisoned cache entry that blocks future requests to the same path. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided input.
Disk exhaustion via zip bomb in Eclipse OpenVSX allows a publisher to cause persistent service disruption on any OpenVSX server instance. A publisher uploads a small, highly compressed VSIX (zip bomb) that the server decompresses without size limits when any client requests a file via /vscode/unpkg/; the decompressed content is cached to java.io.tmpdir under an entry-count eviction policy with no total-size bound, enabling repeated disk exhaustion through new filenames or versions. Impact includes HTTP 500 errors for all uncached resources, publishing failures with 'Failed to read extension file', and a poisoned cache entry that blocks future requests to the same path. No public exploit has been identified at time of analysis, and EPSS data is not available in the provided input.