IT SBIT Services
Schneeberger
DEEN
CVE tracker

whatstk: Unbounded decompression in ZIP loader causes memory and disk exhaustion

CVE-2026-121691Medium 6.7

← All vulnerabilities

Summary

whatstk, a Python library for parsing WhatsApp chat exports, does not limit how much data its ZIP loader extracts. A party that supplies a crafted chat export can use a small ZIP file to exhaust the memory and disk of the process that parses it, which can kill the process. The issue only affects applications that pass untrusted ZIP exports to the library, for example through a web upload.

Affected

  • whatstk 0.7.0 up to but not including 0.9.0
  • Versions 0.9.0 and later are not affected

Fixed in

  • Fixed in whatstk 0.9.0
  • The fix reads archive members directly without extracting them to disk, checks the member count first, and applies a default size limit of 50 MB, adjustable with the max_size argument

Workaround

  • No complete workaround other than upgrading
  • Do not pass untrusted ZIP exports to df_from_whatsapp() or WhatsAppChat.from_source()
  • Accept only plain-text exports, or unpack ZIP files in a size-limited environment
  • Run parsing jobs with memory and disk limits, for example in a container

Exploitation

  • No evidence of exploitation in the wild
  • A proof-of-concept entry exists on Sploitus, but its content could not be verified
  • No listing in the CISA Known Exploited Vulnerabilities catalog found

Our recommendation

  • Check whether any internal tool or web application uses whatstk to parse WhatsApp exports
  • Upgrade whatstk to 0.9.0 or later
  • Until the upgrade is done, do not accept ZIP uploads for chat parsing
  • If upload services remain in use, set max_size lower than the default
  • Limit memory and disk for parsing jobs and monitor for process crashes

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:36.

Original description (NVD)

Improper Handling of Highly Compressed Data (CWE-409) in the ZIP loader of whatstk from 0.7.0 before 0.9.0 allows a party that supplies a chat export to exhaust the memory and the disk of the process that parses it, because _str_from_file() (whatstk/whatsapp/parser.py) calls zip_ref.extractall() with no bound on the size of the members and no check of the compression ratio, then reads the extracted file in full with f.read(). The only guard on the archive counts the extracted files and raises when there is not exactly one, but it runs after extractall() has already written them, so it does not prevent the cost. _clean_text() then passes the whole text through unicodedata.normalize("NFKD", text), which holds a second copy, and the parse builds a list of regular expression matches and a DataFrame over it, so peak memory is a multiple of the decompressed text rather than of the archive. A ZIP is a documented input of WhatsAppChat.from_source() and df_from_whatsapp(), and is the form in which WhatsApp exports a chat on iOS, so the attacker supplies the whole file. This results in a small upload costing hundreds of megabytes of memory and of disk, and in the process being killed where that exceeds what is available.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed