https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T16:49:37.911052+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-39904 fkie_cve-2026-39904 2026-10-04T16:49:37.940938+00:00

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.

 https://vulnerability.circl.lu/vuln/ghsa-42jc-v69j-g38f GHSA-42jc-v69j-g38f — Gophish contains a denial of service vulnerability 2026-10-04T16:49:37.941161+00:00

Affected: Go: github.com/gophish/gophish

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.