🎯 New Report #4028616: Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect encoding()`
🔺Severity: Medium
👽 Reporter: sumit-sabhaya
⭐️ Reputation: 236
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-09-14
⏰ Disclosed: 2026-10-16 10:08:54
📝 Summary: A memory exhaustion vulnerability was discovered in the encoding detection function that loaded entire files into memory without size restrictions. The vulnerability affected the translation discovery process, where a single large translation file could cause peak memory usage to reach approximately three times the file size. This issue was present across multiple code paths and could be triggered automatically during version control system updates, potentially resulting in out-of-memory conditions on resource-constrained systems. The vulnerability was addressed by implementing bounded file reading with a size limit consistent with other sniffing operations in the codebase.
📂 Report JSON File: 4028616
@hackeronereports