CodeVetter · local evidence export

Unbounded zip extraction (zip bomb) in Python

codevetter-public-benchmark/py-zip-bomb

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

Finding

highbenchmark ground truth

resource exhaustion

extractall is called without checking uncompressed sizes or compression ratios, so a small zip bomb can decompress to petabytes and exhaust disk and memory.

source.py:9