Zip Bomb

Zip Bomb — An archive attack that turns a small compressed input into excessive CPU, memory, disk, or recursive extraction work.

A zip-bomb defense cannot rely only on the compressed file size. Nested archives are the classic form, but overlapping-entry techniques can achieve extreme expansion ratios without recursive layers.

Safe Extraction Policy

Upload and scanning pipelines should define resource limits before extraction:

• total expanded bytes
• per-entry size
• entry count
• nesting depth
• CPU/time budget
• compression ratio
• symbolic-link and path-traversal policy

Leaving the limit to free disk space alone can still let one worker consume CPU and memory badly enough to damage tail latency for unrelated jobs.

Source

• https://www.bamsoftware.com/hacks/zipbomb/

Resource-Budget Boundary

Defending against a ZIP bomb should not rely only on compressed size. Limits can cover total expanded bytes, file count, nested-archive depth, CPU time and temporary-storage consumption. Streaming decompression with a per-job resource budget creates a stronger security boundary than assuming that a small input file is cheap to process.