-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cn.hutool:hutool-core | maven | < 5.8.11 | 5.8.11 |
Miggo AIRoot Cause AnalysisThe vulnerability involves uncontrolled resource consumption during ZIP file processing. The primary candidate is the unzip method in ZipUtil.java, as it would handle extraction logic. Resource consumption vulnerabilities in ZIP utilities typically stem from failure to validate entry sizes or limit total extracted data. The lack of explicit resource shutdown (CWE-404) might also relate to unclosed streams in this function, but the primary issue is the lack of safeguards against maliciously crafted ZIP files. The high confidence stems from the correlation between the vulnerability's description, the affected file, and common ZIP-handling pitfalls.