Zip Bomb
A zip bomb (also decompression bomb or zip of death) is a malicious archive file designed to crash or freeze the program or system reading it. Rather than hijacking normal execution, it causes the decompressor to consume excessive time, disk space, memory, or CPU. Zip bombs are often employed to disable antivirus software by forcing it to decompress an archive that never finishes expanding.
The classic: 42.zip
The best-known zip bomb is 42.zip, a file of unknown authorship dating to before June 2001. It consists of 42 KB of compressed data containing five layers of nested zip files in sets of 16. Each bottom-layer archive decompresses to a 4.3 GB file, for a total of approximately 4.5 petabytes of uncompressed data — a compression ratio of roughly 106 billion to one.
Limits of DEFLATE
DEFLATE, the compression algorithm most commonly supported by zip parsers, cannot achieve a compression ratio greater than 1032:1. Recursive bombs like 42.zip work around this by nesting zip files within zip files, multiplying the ratio with each layer. However, most modern decompressors do not recursively unzip nested archives, limiting the practical impact of this approach.
Non-recursive zip bombs
In 2019, David Fifield demonstrated a non-recursive zip bomb that surpasses the DEFLATE limit without nesting. The technique works by overlapping files inside the zip container, allowing multiple file entries to reference a single “kernel” of highly compressed data. The output size grows quadratically with input size:
- 42 KB → 5.5 GB (compression ratio ~129,000)
- 10 MB → 281 TB (compression ratio ~28 million)
- 46 MB → 4.5 PB (using Zip64 extensions, ratio ~98 million)
This construction uses only DEFLATE and is compatible with most zip parsers, though it fails on “streaming” parsers that read the archive in a single pass without consulting the central directory.
Mitigations
- Modern antivirus detects known zip bomb patterns and refuses to extract them
- Filesystems with transparent compression (e.g., ZFS with LZ4) reduce the effective space consumed by decompressed data
- Sandboxing the parser to limit time, memory, and disk usage is the most robust defense — treating zip files with the same caution as image files or other complex formats prone to parser bugs
- Rejecting overlapping files detects Fifield’s specific construction, but does not protect against other zip bomb variants
Simple construction
A basic zip bomb can be created by compressing a stream of zeros:
# 16 GB of zeros compresses to a small file
dd if=/dev/zero bs=1G count=16 | zip zipbomb.zip -This exploits DEFLATE’s high compression ratio on repetitive data. More sophisticated constructions achieve far greater ratios through the techniques described above.
Sources
Related: tar, magic-numbers, local-file-inclusion-attacks