{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/whatstk--0.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:whatstk_project:whatstk:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-121691"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["whatstk (\u003c 0.9.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe whatstk library versions prior to 0.9.0 are vulnerable to CVE-2026-121691, an improper handling of highly compressed data (CWE-409). The \u003ccode\u003e_str_from_file()\u003c/code\u003e function within the parser uses \u003ccode\u003ezip_ref.extractall()\u003c/code\u003e without validating archive member sizes or compression ratios. An attacker providing a maliciously crafted ZIP file can trigger significant memory and disk exhaustion as the library extracts, reads, and processes the contents, eventually leading to a process crash.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a local denial-of-service (DoS) condition. An attacker-supplied archive can cause significant memory and disk usage during the processing of data via \u003ccode\u003eWhatsAppChat.from_source()\u003c/code\u003e or \u003ccode\u003edf_from_whatsapp()\u003c/code\u003e, potentially crashing the application or the hosting service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ewhatstk\u003c/code\u003e library to version 0.9.0 or later immediately to resolve the vulnerable ZIP parsing logic.\u003c/li\u003e\n\u003cli\u003eAudit services that utilize \u003ccode\u003ewhatstk\u003c/code\u003e to process user-supplied ZIP files to identify potential exposure points.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T18:59:49Z","date_published":"2026-11-10T18:59:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-whatstk-zip-exhaustion/","summary":"A vulnerability in whatstk before version 0.9.0 allows attackers to perform a denial-of-service attack via resource exhaustion by supplying a maliciously crafted ZIP-compressed WhatsApp chat export.","title":"whatstk: Unbounded ZIP decompression denial-of-service (CVE-2026-121691)","url":"https://feed.craftedsignal.io/briefs/2026-11-whatstk-zip-exhaustion/"}],"language":"en","title":"CraftedSignal Threat Feed - Whatstk (\u003c 0.9.0)","version":"https://jsonfeed.org/version/1.1"}