HOME VULNERABILITIESCVE-2026-3816

MEDIUM

CVE-2026-3816

CWE-404Published: March 9, 2026· Updated: Mar 10, 2026

6.5

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.5th

Official Description

A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.

Technical Analysis

CVE-2026-3816 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Vendors & Products

owasp1 product

defectdojo

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/DefectDojo/django-DefectDojo/commit/e8f1e5131535b8fd80a7b1b3085d676295fdcd41

PATCHhttps://github.com/DefectDojo/django-DefectDojo/pull/14408

ADVISORYhttps://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md

ADVISORYhttps://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md#supporting-materialreferences

ADVISORYhttps://vuldb.com/?id.349782

ADVISORYhttps://vuldb.com/?submit.769524

All References (8)

→

https://github.com/DefectDojo/django-DefectDojo/commit/e8f1e5131535b8fd80a7b1b3085d676295fdcd41Patch

→

https://github.com/DefectDojo/django-DefectDojo/pull/14408Issue Tracking · Patch

→

https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.56.0Release Notes

→

https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.mdExploit · Third Party Advisory

→

https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md#supporting-materialreferencesExploit · Third Party Advisory

→

https://vuldb.com/?ctiid.349782Permissions Required · VDB Entry

→

https://vuldb.com/?id.349782Third Party Advisory · VDB Entry

→

https://vuldb.com/?submit.769524Third Party Advisory · VDB Entry

Quick Facts

CVE IDCVE-2026-3816

CVSS Score6.5 / 10

SeverityMEDIUM

WeaknessCWE-404

CISA KEVNo

EPSS (30d)0.02%

Affected1 vendor

PublishedMar 9, 2026

Related CVEs (CWE-404)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2026-3816 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2026-3816·NVD