CodeChecker 6.29.0 performs an unbounded zlib decompression of an attacker‑controlled Base64 string when the store.analysis_statistics_dir option is enabled. Because no maximum decompressed size is enforced, an authorized but non‑superuser account can submit a payload that exhausts API worker or host memory and writes large amounts of data to disk, causing availability loss. The weakness is a classic memory‑leak and amplification flaw that leads to service disruption.

The vulnerability affects Ericsson CodeChecker version 6.29.0. The feature is disabled by default, but if an operator enables store.analysis_statistics_dir, any client with PRODUCT_STORE permission can trigger the decompression routine. Thus the affected environment is an operable CodeChecker instance with the statistics directory enabled and an account possessing the appropriate product privilege.

The CVSS score of 4.9 indicates a medium severity DoS risk. EPSS is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation so far. The attack vector is authenticated remote over Thrift‑over‑HTTP; it requires legitimate permission and offers no authorization bypass or path traversal. An attacker could reliably exhaust system resources whenever the vulnerable method is exposed.