CVE-2026-66913

Technical Description

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.

An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.

The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.

The patch introduces:

* A 1 GB cumulative uncompressed-size limit for imported capture archives.

* Size-limited gzip and zlib decompression for compressed HAR files.

* Explicit detection and handling of suspected z

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References