GHSA-8823-qg2x-pv9f: Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
Gzip Decompression Bomb Bypasses Sitemap Size LimitSummary`ultimate-sitemap-parser` enforces a 100 MiB size limit on sitemap responses, but applies it only to the **compressed** bytes received over the network. When a `.gz` sitemap is fetched, `usp/helpers.py:239` calls `gzip_lib.decompress(data)` with no output-size cap, allowing an attacker-controlled server to serve a small gzip-compressed payload (~549 KB) that expands to over 120 MiB in process memory. This completely bypasses the declared limit and can exhaust memory or crash any process that calls `sitemap_tree_for_homepage()` against an untrusted site.DetailsThe library declares a maximum sitemap size constant in `usp/fetch_parse.py:64`:Despite the comment saying "uncompressed", this value is passed directly to the HTTP client layer at `usp/fetch_parse.py:130`:The HTTP client (`usp/web_client/requests_client.py:57-58`) slices only the raw compressed response bytes:The truncated (but still compressed) bytes are then passed through the pipeline to `usp/fetch_parse.py:175`:Inside `ungzipped_response_content` (`usp/helpers.py:265-267`), when the URL ends in `.gz` or the response carries a gzip content type, decompression is triggered:The `gunzip` function (`usp/helpers.py:239`) decompresses without any output-size guard:No post-decompression size check exists anywhere in the call chain. Dynamic reproduction confirmed that 549,213 bytes of compressed input passed the 100 MiB gate check (`compressed < limit → True`) and then expanded to 125,829,234 bytes (120.0 MiB) in memory with no exception raised.PoC**Environment setup:****Alternatively, run directly:****PoC script (`poc.py`) — abbreviated attack flow:****Expected output:**The parser fetches `/sitemap.xml.gz`, passes the compressed-size gate check, decompresses 549 KB into 120 MiB in process memory, and returns normally without raising an exception.**Remediation:**ImpactAny application that calls `sitemap_tree_for_homepage()` (or the underlying fetch/parse pipeline) against an attacker-controlled or compromised domain is vulnerable. The attacker only needs to control a web server that serves a valid `robots.txt` pointing to a gzip-compressed sitemap URL. No authentication or special configuration is required; the vulnerability is triggered by default library behavior.A ~549 KB compressed payload expands to 120 MiB in process memory. Larger bombs are possible up to the compressed-size limit (100 MiB of compressed data could expand to tens of gigabytes). Repeated requests or sufficiently large bombs can cause out-of-memory crashes, service disruptions, or denial of service in any process or service that performs sitemap crawling.This vulnerability is a **Denial of Service via Uncontrolled Resource Consumption (Decompression Bomb / Zip Bomb)**. Affected parties include:SEO tooling, search engine crawlers, and indexing services using this library.Web frameworks and microservices that expose a sitemap-crawling endpoint to external input.Any automated pipeline that regularly crawls third-party sitemaps.Reproduction artifacts`Dockerfile``poc.py`
CVSS v3.1: 7.5