Is dfir-unfurl affected by CVE-2026-40036?

PyPI dfir-unfurl is affected in <20260405.

Is CVE-2026-40036 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

high

CVE-2026-40036

Q: Is CVE-2026-40036 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.5%.

PyPI · dfir-unfurl

Summary

Unfurl's unbounded zlib decompression allows decompression bomb DoS

Severity: high
EPSS: 0.5% (p39)
Also known as: GHSA-h5qv-qjv4-pc5m
Published: 2026-01-29

References

https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-h5qv-qjv4-pc5m
https://nvd.nist.gov/vuln/detail/CVE-2026-40036
https://github.com/RyanDFIR/unfurl/pull/243

Related advisories

GHSA-vg9h-jx4v-cwx2 — critical · PyPI/dfir-unfurl

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.