CVE-2026-22870: GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
Summary
CVE-2026-22870: GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS. Affects guarddog versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GuardDog is a security tool designed to scan Python packages for vulnerabilities, ensuring that developers can maintain secure applications. It utilizes various extraction methods to handle package files, including ZIP archives. However, the tool has a critical vulnerability in its safe_extract() function, which fails to validate the size of decompressed files when extracting ZIP archives, making it susceptible to denial of service attacks through zip bombs.
Vulnerability Detail
The vulnerability arises from the lack of size validation in the safe_extract() function of GuardDog when handling ZIP files. Attackers can exploit this by uploading a malicious package that, while small in size, expands to consume excessive disk space upon extraction. This can lead to denial of service scenarios, including disruption of CI/CD pipelines, resource exhaustion in local development environments, and potential supply chain attack amplification. The absence of decompressed size limits, compression ratio validation, file count limits, and total extracted size validation are critical technical aspects of this vulnerability.
How To Fix
Latest published version: 3.2.0 as of 23 Oct 2026
pip install --upgrade "guarddog==3.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.1
This is the first release that contains the fix.
pip install --upgrade "guarddog==2.7.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using ZIP files from untrusted sources or implement manual checks on the size of extracted files before processing them further. Additionally, consider using alternative extraction methods that include size validation.
Conclusion
The GuardDog Zip Bomb Vulnerability (CVE-2026-22870) poses a significant risk to applications using the GuardDog package due to its failure to validate decompressed file sizes. It is crucial for developers to update to the patched version and implement best practices to mitigate potential risks.
See every vulnerability recorded for guarddog →
FAQ
A zip bomb is a malicious file designed to crash or render a system unusable by consuming excessive resources when decompressed.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The potential impacts include denial of service in CI/CD pipelines, resource exhaustion in local environments, and increased workload for security teams due to manual intervention.
While updating is the best solution, you can mitigate the risk by avoiding ZIP files from untrusted sources and implementing manual size checks.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for guarddog.
