CVE-2026-66913
Published: July 28th, 2026
Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.
An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.
The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.
The patch introduces:
* A 1 GB cumulative uncompressed-size limit for imported capture archives.
* Size-limited gzip and zlib decompression for compressed HAR files.
* Explicit detection and handling of suspected zip bombs.
* An HTTP 400 response when an oversized compressed HAR file is submitted through the API.
Unknown
CVSS v2:
CVSS v2:
Status
| DocFilters Release | Package | State | Justification | Comment |
|---|---|---|---|---|
| 26.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 26.2 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 26.1 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 25.4 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 25.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 25.2 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 25.1 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 24.4 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 24.4.0 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 24.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 24.2 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 24.1 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 23.3 | zlib (1.3) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 23.2 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 23.1 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 22.4 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 22.3 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 22.2 | zlib (1.2.12) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 22.1 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 21.11 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 21.8 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 21.5.0 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 21.2.0 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.19.3667 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.18.3599 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.16.3445 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.15.3368 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.14.3263 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.13.3179 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.12.3054 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.11.3040 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.11.2990 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.10.2934 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.9.2878 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |
| 11.4.8.2822 | zlib (1.2.11) | Not Affected | Code Not Present | The vulnerable code is Lookyloo’s own capture-archive/HAR import handling (a standalone Python web application by CIRCL), not zlib itself. Document Filters does not vendor, build, or run any Lookyloo code and has no capture-archive or HAR-import feature; the CVE’s application-level defect is never exercised regardless of how Document Filters’ own zlib-based ZIP/gzip decompression (shared/core/source/ISYSzlib.cpp, ISYSzipfile.cpp, filters/isysreaders/readers/ReaderGz.cpp) behaves. |