DoS in DefectDojo 2.55.4 SonarQube/MSDefender Parser, Fixed 2.56.0
CVE-2026-3816 Published on March 9, 2026
OWASP DefectDojo SonarQubeParser/MSDefenderParser parser.py input_zip.read denial of service
A security vulnerability has been detected in OWASP DefectDojo up to 2.55.4. This vulnerability affects the function input_zip.read of the file parser.py of the component SonarQubeParser/MSDefenderParser. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.56.0 is able to resolve this issue. The identifier of the patch is e8f1e5131535b8fd80a7b1b3085d676295fdcd41. Upgrading the affected component is recommended.
Timeline
Advisory disclosed
VulDB entry created
VulDB entry last update
Weakness Type
Improper Resource Shutdown or Release
The program does not release or incorrectly releases a resource before it is made available for re-use. When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
Affected Versions
OWASP DefectDojo:- Version 2.55.0 is affected.
- Version 2.55.1 is affected.
- Version 2.55.2 is affected.
- Version 2.55.3 is affected.
- Version 2.55.4 is affected.
- Version 2.56.0 is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.