Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
Date: 2026-06
Affected: pip/ultimate-sitemap-parser
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CWE: CWE-400
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

## Gzip Decompression Bomb Bypasses Sitemap Size Limit ### Summary `ultimate-sitemap-parser` enforces a 100 MiB size limit on sitemap responses, but applies it only to the **compressed** bytes received over the network. When a `.gz` sitemap is fetched, `usp/helpers.py:239` calls `gzip_lib.decompress(data)` with no output-size cap, allowing an attacker-controlled server to serve a small gzip-compressed payload (~549 KB) that expands to over 120 MiB in process memory. This completely bypasses the declared limit and can exhaust memory or crash any process that calls `sitemap_tree_for_homepage()` against an untrusted site. ### Details The library declares a maximum sitemap size constant in `usp/fetch_parse.py:64`: ```python __MAX_SITEMAP_SIZE = 100 * 1024 * 1024 # Max. uncompressed sitemap size ``` Despite the comment saying "uncompressed", this value is passed directly to the HTTP client layer at `usp/fetch_parse.py:130`: ```python web_client.set_max_response_data_length(self.__MAX_SITEMAP_SIZE) ``` The HTTP client (`usp/web_client/requests_client.py:57-58`) slices only the raw compressed response bytes: ```python data = self.__requests_response.content[: self.__max_response_data_length] ``` The truncated (but still compressed) bytes are then passed through the pipeline to `usp/fetch_parse.py:175`: ```python response_content = ungzipped_response_content(url=self._url, response=response) ``` Inside `ungzipped_response_content` (`usp/helpers.py:265-267`), when the URL


Mitigations:

Architectural layers (MAESTRO):