Bug 2447514 (CVE-2026-32630)

Summary:	CVE-2026-32630 file-type: file-type: Denial of Service via excessive memory growth from crafted ZIP files
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, alizardo, anthomas, bbrownin, caswilli, cmah, dschmidt, eaguilar, ebaron, ehelms, erezende, eric.wittmann, ggainey, janstey, jcantril, jchui, jhe, jlanda, jolong, juwatts, kaycoth, kshier, ktsao, mhulan, nboldt, nipatil, nmoumoul, osousa, pantinor, pcreech, pjindal, psrna, rchan, rkubis, rojacob, sdawley, simaishi, smallamp, smcdonal, stcannon, teagle, tmalecek, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in file-type, a utility for detecting file types. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP file to an application using file-type's buffer or file-based detection functions. This can lead to excessive memory growth, causing a Denial of Service (DoS) due to the application attempting to inflate and process a much larger payload than expected.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-03-13 22:01:43 UTC

file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP inflate output limit is enforced for stream-based detection, but not for known-size inputs. As a result, a small compressed ZIP can cause file-type to inflate and process a much larger payload while probing ZIP-based formats such as OOXML. This vulnerability is fixed in 21.3.2.