{"id":"EUVD-2026-38351","enisaUuid":"3f642f0d-0a3f-3efd-aacd-3789264f843d","description":"Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.","datePublished":"Jun 22, 2026, 8:11:14 PM","dateUpdated":"Oct 8, 2026, 3:22:32 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ashikmd7/GoPhish-0.12.1/blob/main/Unbounded%20Memory%20Allocation%20in%20Office%20Attachment%20Processing%20Leads%20to%20Server%20DoS/README.md\nhttps://www.vulncheck.com/advisories/gophish-denial-of-service-via-office-document-upload\n","aliases":"CVE-2026-39904\nGHSA-42jc-v69j-g38f\n","assigner":"VulnCheck","epss":0.44,"enisaIdProduct":[{"id":"6930610d-1c46-3edb-a75c-06172411fd8f","product":{"name":"gophish","vendor":{"name":"Gophish"}},"product_version":"0 ≤0.12.1"}],"enisaIdVendor":[{"id":"8d391b48-b308-3347-aff3-553dd871b85f","vendor":{"name":"Gophish"}}],"enisaIdVulnerability":[{"id":"87693e36-738b-35e5-b046-331dc13a9679","vulnerability":{"id":"GHSA-42jc-v69j-g38f","description":"Gophish contains a denial of service vulnerability","datePublished":"Jun 22, 2026, 9:31:00 PM","dateUpdated":"Aug 6, 2026, 7:16:24 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-39904\nhttps://github.com/ashikmd7/GoPhish-0.12.1/blob/main/Unbounded%20Memory%20Allocation%20in%20Office%20Attachment%20Processing%20Leads%20to%20Server%20DoS/README.md\nhttps://github.com/gophish/gophish\nhttps://www.vulncheck.com/advisories/gophish-denial-of-service-via-office-document-upload\n","enisa_id":"EUVD-2026-38351\n","aliases":"GHSA-42jc-v69j-g38f\nCVE-2026-39904\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:59:14 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fab2672a-b554-3c41-8784-af78b4445480","vulnerability":{"id":"CVE-2026-39904","description":"Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.","datePublished":"Jun 22, 2026, 8:11:14 PM","dateUpdated":"Oct 8, 2026, 3:22:32 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ashikmd7/GoPhish-0.12.1/blob/main/Unbounded%20Memory%20Allocation%20in%20Office%20Attachment%20Processing%20Leads%20to%20Server%20DoS/README.md\nhttps://www.vulncheck.com/advisories/gophish-denial-of-service-via-office-document-upload\n","enisa_id":"EUVD-2026-38351\n","assigner":"VulnCheck","epss":0.44,"dataProcessed":"Nov 9, 2026, 7:12:20 AM","vulnerabilityProduct":[{"id":"36947625-ab8e-38ec-88c2-c9a20d87c5bc","product":{"name":"gophish","vendor":{"name":"Gophish"}},"product_version":"0 ≤0.12.1"}],"vulnerabilityVendor":[{"id":"5352e624-2a88-3f10-a98b-2f5e1fd40846","vendor":{"name":"Gophish"}}]}}],"enisaIdAdvisory":[]}