usvg SVGZ decompression bomb in `Tree::from_data`
usvg automatically decompresses SVGZ in Tree::from_data, enabling a gzip decompression-bomb denial of service.
A Full Disclosure post describes a decompression-bomb flaw in the Rust usvg SVG library. Tree::from_data detects gzip magic bytes and decompresses SVGZ input before parsing. A small compressed payload can force excessive expansion and deny service to applications that parse untrusted SVG. No CVE is mentioned.
- Tree::from_data detects gzip magic and decompresses SVGZ before parsing.
- A small compressed file can expand into a resource-exhaustion denial of service.
- No CVE identifier is listed in the disclosure.
From the original article
Posted by Khashayar Fereidani on Sep 26 # usvg SVGZ decompression bomb in `Tree::from_data` https://fereidani. com/usvg-svgz-decompression-bomb-in-treefromdata https://fereidani. com/contact ## Description `Tree::from_data` in `crates/usvg/src/parser/mod.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.