Vulnerability · Published Aug 18, 2026 · Assigned by CERT-PL

CVE-2026-18929Resource Exhaustion in Carbone

Medium 6.9

In plain English

A medium-severity security flaw in Carbone from Carbone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a significantly larger size, causing excessive memory consumption and crashing the application server. The issue was fixed in versions: 3.8.2, 4.26.3 and 5.4.4. The fix is available across all distribution types.

Affected products (as reported)

Vendor	Product	Versions
Carbone	Carbone	0 – before 3.8.20 – before 4.26.30 – before 5.4.4

Weakness: CWE-409 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

References

https://cert.pl/en/posts/2026/08/CVE-2026-18929 third-party-advisory
https://carbone.io/ product
https://github.com/carboneio/carbone/commit/eb9b4cff992cc1cb1a319d7fc0cbd09160dc214e patch