Threat Investigation
Request a demo

CVE-2026-22870

High

Description

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. This vulnerability is fixed in 2.7.1.

SeverityHigh
CVSS7.5
Exploit probability—
ProductDatadoghq Guarddog
PublishedJan 13, 2026
First seenJan 13, 2026
Weakness typeCWE-409CWE-409

How to fix

Update
  • datadoghq guarddog2.7.1 or later
  • guarddog2.7.1 or later

Affected products

ProductAffected versionsFixed in
datadoghq guarddogv < 2.7.12.7.1
guarddogPyPIv < 2.7.12.7.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.