CVE-2026-68924: MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIP_MAX_UNCOMPRESSED_FILE_SIZE (400 MB) and logs “Skipping” — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk.
References
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
- github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
- github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9
- github.com/advisories/GHSA-x768-8642-mmq9
- nvd.nist.gov/vuln/detail/CVE-2026-68924
Code Behaviors & Features
Detect and mitigate CVE-2026-68924 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →