Cpe:2.3:a:whatstk_project:whatstk:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awhatstk_projectwhatstk/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 18:59:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgwhatstk: Unbounded ZIP decompression denial-of-service (CVE-2026-121691)https://feed.craftedsignal.io/briefs/2026-11-whatstk-zip-exhaustion/Tue, 10 Nov 2026 18:59:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-whatstk-zip-exhaustion/A vulnerability in whatstk before version 0.9.0 allows attackers to perform a denial-of-service attack via resource exhaustion by supplying a maliciously crafted ZIP-compressed WhatsApp chat export.The whatstk library versions prior to 0.9.0 are vulnerable to CVE-2026-121691, an improper handling of highly compressed data (CWE-409). The _str_from_file() function within the parser uses zip_ref.extractall() without validating archive member sizes or compression ratios. An attacker providing a maliciously crafted ZIP file can trigger significant memory and disk exhaustion as the library extracts, reads, and processes the contents, eventually leading to a process crash.

Impact

Successful exploitation results in a local denial-of-service (DoS) condition. An attacker-supplied archive can cause significant memory and disk usage during the processing of data via WhatsAppChat.from_source() or df_from_whatsapp(), potentially crashing the application or the hosting service.

Recommendation

  • Upgrade the whatstk library to version 0.9.0 or later immediately to resolve the vulnerable ZIP parsing logic.
  • Audit services that utilize whatstk to process user-supplied ZIP files to identify potential exposure points.
]]>mediumadvisory