Improper Handling of Highly Compressed Data (Data Amplification)

Often called a 'decompression bomb' or 'zip bomb,' this attack exploits the extreme compression ratios possible with formats like ZIP, XML, or PDF. A malicious actor can craft a tiny, harmless-looking file that, when processed by your application, expands to consume gigabytes of memory or disk space, leading to denial of service, crashes, or performance degradation. To prevent this, developers must implement security controls before decompression. This includes setting strict limits on the compression ratio, checking the uncompressed size from file headers before allocating memory, and using streaming decompression with quotas instead of loading entire outputs into memory at once. Treating all compressed input as untrusted and validating its potential impact is a critical step in secure file handling.