Cybersecurity glossary
What is a Zip Bomb?
Learn what a zip bomb is, how nested and overlapping ZIP ratio attacks exhaust disk and memory, how it differs from path traversal (zip slip), and how to prevent unsafe archive expansion.
Definition
A zip bomb is a malicious ZIP (or similar archive) crafted so that decompression produces an enormous amount of data relative to the small compressed file—often via nested archives or overlapping compressed streams—exhausting disk, memory, or CPU during extraction.
Why zip bombs matter
Upload and unpack features assume archives are “just files.” Zip bombs weaponize ZIP’s compression model so a kilobyte-scale upload expands into enormous output. Nested archives and overlapping stream tricks make naive extractors and recursive scanners especially fragile.
Unlike zip slip, which aims to overwrite paths, a zip bomb’s goal is availability: fill disks, spike CPU, or stall workers that process file uploads.
How a zip bomb attack unfolds
Craft a high-ratio archive
Build nested ZIPs, highly compressible payloads, or overlapping entry layouts that expand far beyond the compressed bytes.
Deliver via an unpack path
Upload the archive, attach it to a ticket, or feed it to a pipeline that auto-extracts content.
Trigger expansion
The server, antivirus, or preview service opens entries—often recursively for nested members.
Amplify without proportional input
Each nested layer or overlapping stream multiplies written bytes while the on-wire size stays tiny.
Exhaust local resources
Temp disks fill, memory balloons, extract workers hang, and legitimate jobs queue behind the bomb.
Deny service
Uploads, scans, or whole instances fail until the bomb is cleared and limits are enforced.
What makes ZIP bombs distinct
Nested archives
ZIP-in-ZIP trees force recursive extractors to expand layer after layer until quotas collapse.
Overlapping streams
Crafted layouts reuse compressed regions so many files inflate from the same small byte range.
Ratio, not traversal
Impact is amplification DoS—not writing outside the extract tree like zip slip.
Scanner self-DoS
Security tools that unpack deeply can be the first component knocked offline.
Prevention
| Practice | Detail |
|---|---|
| Bound expansion | Enforce max uncompressed bytes, max entries, max nesting depth, and max compression ratio before writing further. |
| Stream with meters | Decompress with running counters; abort when any budget is exceeded rather than extracting fully then checking. |
| Isolate extractors | Unpack in sandboxes or jobs with disk/CPU quotas so one bomb cannot starve the main app. |
| Separate zip slip controls | Still canonicalize entry paths and reject absolute/`../` names—ratio limits do not stop path traversal. |
- Reject archives that exceed size, entry-count, nesting, or ratio thresholds before full extract.
- Disable unnecessary recursive unpacking in upload, email, and CI artifact handlers.
- Monitor extract job duration, temp disk usage, and OOM events as zip-bomb signals.
- Prefer libraries that expose progress hooks and hard abort APIs over shelling out to unzip.
- Quarantine suspicious archives instead of auto-previewing every member.
- Test with known high-ratio and nested samples in staging to verify fail-closed behavior.
- Document that zip bombs are a subset of decompression bombs focused on ZIP-family archives.
- Treat auto-extract features as high-risk [security misconfiguration](/glossary/security-misconfiguration) if left unbounded.
The practical takeaway
A zip bomb is a ZIP-centric amplification attack—nested and overlapping constructions that turn tiny archives into huge expansions. Cap ratio, depth, and size at the extractor, and do not confuse this with zip slip path abuse.
If your product unpacks user ZIPs, assume every archive is hostile until budgets say otherwise.
Related security terms
Decompression Bomb
The broader class of bombs across gzip, xz, brotli, images, and other codecs—not only ZIP.
Zip Slip
Path-traversal via archive entry names, distinct from ratio-based exhaustion.
File Upload Vulnerability
Upload sinks are the usual place zip bombs enter applications.
Resource Exhaustion
The availability impact when expansion consumes disk, RAM, or CPU without bounds.
Frequently asked questions
What is a zip bomb in simple terms?
A tiny ZIP file that expands into gigabytes or more when you unzip it—enough to fill disks, crash scanners, or freeze upload pipelines.
How do nested zip bombs work?
Each layer is a small archive containing more archives. Naïve recursive extractors multiply size at every level until resources are gone.
What is an overlapping zip bomb?
Some ZIP constructions reuse the same compressed bytes for many logical files (overlapping local file data), so reported uncompressed size and actual expansion blow up without needing deep nesting.
Is a zip bomb the same as zip slip?
No. Zip bombs abuse compression ratios and nesting for denial of service. Zip slip abuses `../` in entry names to write outside the extract directory.
Where do zip bombs usually appear?
User uploads, email attachments, CI artifact unpackers, antivirus/sandbox extractors, and any service that auto-unzips content for preview or analysis.
How do you prevent zip bomb damage?
Cap compressed size, uncompressed size, entry count, nesting depth, and expansion ratio; extract to a quota-limited volume; never recursively unpack without budgets.
Can antivirus alone stop zip bombs?
Signatures help for known samples, but novel ratio tricks still need application-level limits. Scanners themselves must also bound decompression.
References
Explore authoritative guidance and frameworks related to zip bomb.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.