{"vulnerability": "cve-2026-3924", "sightings": [{"uuid": "635f9422-4050-45fb-a8a5-664c253216cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3924", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260316", "content": "", "creation_timestamp": "2026-03-16T01:00:00.000000Z"}, {"uuid": "ecada4be-55a4-4358-82bc-dad02e796ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3924", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgvgfyd5b62u", "content": "", "creation_timestamp": "2026-03-12T22:15:44.738550Z"}, {"uuid": "2bae9fac-e39d-458a-b64e-2e45e159049f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3924", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0298/", "content": "", "creation_timestamp": "2026-03-16T00:00:00.000000Z"}, {"uuid": "28ac239a-66c3-4474-88a9-d0628844fc77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-3924", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260312", "content": "", "creation_timestamp": "2026-03-12T01:00:00.000000Z"}, {"uuid": "34f79bf7-cfa5-4c95-bb58-c4c736cfd383", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39244", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7vomq242s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-39244 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 adm-zip: \u0443\u0433\u0440\u043e\u0437\u0430 \u043e\u0442\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\n\n\nhttps://kripta.biz/posts/BC9DDCC9-DBB3-441C-B6D5-3041FF8983BA", "creation_timestamp": "2026-07-10T22:43:15.977301Z"}, {"uuid": "74854b6f-eb9c-479e-9d67-e9993d30caae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39243", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfr7vgij2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-39243 \u0432 Decompress: \u0440\u0438\u0441\u043a\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/91B267A6-7253-4830-9651-ABACE7805D72", "creation_timestamp": "2026-07-11T00:28:07.710788Z"}, {"uuid": "91a1efa0-4280-4d9a-bc00-2b5c95029e96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39246", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfxmi2yn2s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-39246 \u0432 Decompress: \u0440\u0438\u0441\u043a\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0441\u0441\u044b\u043b\u043e\u043a \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0430\u0440\u0445\u0438\u0432\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/FFF00BD3-5FD2-44E3-A803-5509DD317EFC", "creation_timestamp": "2026-07-11T00:31:42.207385Z"}, {"uuid": "dff1462f-ff5e-438f-8378-3c136e51dff8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39245", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg6bv4xc2i", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-39245 \u0432 Decompress: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/0C95438C-C023-4F01-BAFC-283B310F06BD", "creation_timestamp": "2026-07-11T00:35:25.876601Z"}, {"uuid": "f2c4e4e9-ef5f-4f34-8533-f7f892735e11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39244", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhatsfd72s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-39244 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 adm-zip: \u0443\u0433\u0440\u043e\u0437\u0430 DoS \u0447\u0435\u0440\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 ZIP-\u0444\u0430\u0439\u043b\u044b\n\n\n\nhttps://kripta.biz/posts/C369E3A4-10BC-45C9-B372-0062D930F0C6", "creation_timestamp": "2026-07-11T00:54:45.593632Z"}, {"uuid": "64d8611c-6d01-41dc-8e19-a9e1f7bca03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39244", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfhbw76bo2m", "content": "\ud83d\udfe0 CVE-2026-39244 - High (7.5)\n\nadm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulate...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-39244/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-11T20:00:41.501678Z"}, {"uuid": "7b06600a-c09a-4593-ac93-f6f03e1c17f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39245", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqk3qeflq22e", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-39245 \u0432 Decompress: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/713ACEF2-0E26-49CC-84C5-DDF46800319D", "creation_timestamp": "2026-07-13T16:17:19.601772Z"}, {"uuid": "5f613e45-ccfc-424d-878c-0c546cad3f82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39244", "type": "seen", "source": "https://gist.github.com/alon710/c1601faeeb98f64d91d4b127606bd4dc", "content": "# GHSA-RCW4-F5RP-G42V: GHSA-RCW4-F5RP-G42V: Uncontrolled Resource Consumption and Decompression Bomb Protection Bypass in adm-zip\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/GHSA-RCW4-F5RP-G42V\n\n## Summary\nA critical denial-of-service vulnerability in the adm-zip npm package allows attackers to bypass decompression-bomb protections introduced in version 0.5.18. By declaring the uncompressed file size as exactly 0, an attacker can disable the maxOutputLength constraint in the Node.js zlib wrapper, leading to complete system memory exhaustion and process crashes.\n\n## TL;DR\nA bypass of the decompression bomb protection in adm-zip (CVE-2026-39244) allows attackers to trigger out-of-memory crashes by setting the declared uncompressed size header of a malicious ZIP entry to 0, which disables zlib limits.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption)\n- **Attack Vector**: Network / Remote\n- **CVSS Score**: 7.5 (High)\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing adm-zip to parse, read, or decompress ZIP archives\n- **adm-zip**: >= 0.5.18 < 0.6.1 (Fixed in: `0.6.1`)\n- **adm-zip**: < 0.5.18 (Fixed in: `0.5.18`)\n\n## Mitigation\n\n- Upgrade adm-zip package to version 0.6.1 or above to enforce stream caps.\n- Deploy container-level memory limits (e.g., Docker memory limits) to prevent system-wide crashes.\n- Sanitize file upload formats and restrict maximum file upload size at the gateway layer (e.g., NGINX client_max_body_size).\n\n**Remediation Steps:**\n1. Open package.json and locate the adm-zip entry under dependencies.\n2. Update the version string to ^0.6.1.\n3. Run npm install or yarn install to apply the dependency patch.\n4. Validate the fix by executing the regression scripts in a staging environment.\n\n## References\n\n- [GitHub Advisory Database (GHSA-RCW4-F5RP-G42V)](https://github.com/advisories/GHSA-RCW4-F5RP-G42V)\n- [NVD CVE Record (CVE-2026-39244)](https://nvd.nist.gov/vuln/detail/CVE-2026-39244)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-39244)\n- [adm-zip npm Package Registry](https://www.npmjs.com/package/adm-zip)\n- [adm-zip GitHub Repository](https://github.com/cthackers/adm-zip)\n- [adm-zip Release v0.6.1](https://github.com/cthackers/adm-zip/releases/tag/v0.6.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-RCW4-F5RP-G42V) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T19:30:31.000000Z"}]}