CVE-2026-18929

Medium

Description

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4. The fix is available across all distribution types.

SeverityMedium

CVSS6.9

Exploit probability—

ProductCarbone

PublishedAug 18, 2026

First seenAug 18, 2026

Weakness typeCWE-409CWE-409

How to fix

Update

Carbone Carbone3.8.2, 4.26.3, 5.4.4 or later

Patches

github.com/carboneio/carbone/commit/eb9b4cff992cc1cb1a319d7fc0cbd09160dc214e

Affected products

Product	Affected versions	Fixed in
Carbone Carbone	v < 3.8.2, v < 4.26.3, v < 5.4.4	3.8.2, 4.26.3, 5.4.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.