The vulnerability in Lookyloo arises from a lack of limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker can craft a ZIP, gzip, or zlib archive that expands to a very large size when decompressed in memory. This can exhaust available memory, crash web or worker processes, or render the Lookyloo instance unavailable. The weakness is described by CWE-400, representing insufficient limits on resource consumption.

The impacted product is Lookyloo from the vendor lookyloo. Version information is not supplied in the advisory, so all current releases up to the patch are considered vulnerable until a fixed release is deployed.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is below 1%, suggesting low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. However, attackers can use the public upload or API endpoints to deliver specially crafted compressed files. If exploited repeatedly, the system can enter a persistent denial-of-service state until processes or the instance are restarted.