CWE-409 (对高度压缩数据的处理不恰当(数据放大攻击)) — Vulnerability Class 39

CWE-409 represents a critical input validation weakness where software fails to adequately manage inputs with extreme compression ratios, leading to data amplification during decompression. Attackers typically exploit this vulnerability by crafting malicious archives, such as "decompression bombs," which are deceptively small but expand into massive amounts of data upon extraction. This exploitation can rapidly exhaust system memory, CPU resources, or disk space, resulting in denial-of-service conditions or application crashes. To mitigate this risk, developers must implement strict limits on decompression sizes and monitor resource consumption during the process. Effective defenses include setting maximum allowable output thresholds, using timeout mechanisms to halt prolonged decompression tasks, and validating input complexity before processing. By enforcing these constraints, organizations can prevent attackers from leveraging compression algorithms to overwhelm system resources and maintain service availability.