Zip Bomb
An archive attack that turns a small compressed input into excessive CPU, memory, disk, or recursive extraction work.
A zip-bomb defense cannot rely only on the compressed file size. Nested archives are the classic form, but overlapping-entry techniques can achieve extreme expansion ratios without recursive layers.
Safe Extraction Policy
Upload and scanning pipelines should define resource limits before extraction:
- total expanded bytes
- per-entry size
- entry count
- nesting depth
- CPU/time budget
- compression ratio
- symbolic-link and path-traversal policy
Leaving the limit to free disk space alone can still let one worker consume CPU and memory badly enough to damage tail latency for unrelated jobs.
Source
- https://www.bamsoftware.com/hacks/zipbomb/