CVE-2026-39373: Python Zlib Unbounded Decompressioncve-2026-39373-python-zlib-unbounded-decompression
Unbounded decompression using `zlib` can lead to a Denial of Service (DoS) via memory exhaustion (Zip Bomb) if the compressed data is untrusted. `zlib.decompress` does not allow limiting the output size. Instead, use `zlib.decompressobj().decompress(data, max_length)` with a safe maximum length to restrict the decompressed payload size.
