@blamejs/exceptd-skills 0.16.16 → 0.16.17

package/data/_indexes/xref.json

@@ -42,6 +42,7 @@
     "CWE-22": [
       "api-security",
       "attack-surface-pentest",
+      "decompression-dos",
       "mail-server-hardening",
       "mcp-agent-trust",
       "webapp-security"
@@ -238,6 +239,7 @@
       "mail-server-hardening"
     ],
     "CWE-400": [
+      "decompression-dos",
       "mail-server-hardening",
       "multitenancy-isolation"
     ],
@@ -251,10 +253,23 @@
       "multitenancy-isolation"
     ],
     "CWE-770": [
+      "decompression-dos",
       "multitenancy-isolation"
     ],
     "CWE-668": [
       "multitenancy-isolation"
+    ],
+    "CWE-409": [
+      "decompression-dos"
+    ],
+    "CWE-1333": [
+      "decompression-dos"
+    ],
+    "CWE-776": [
+      "decompression-dos"
+    ],
+    "CWE-834": [
+      "decompression-dos"
     ]
   },
   "d3fend_refs": {
@@ -378,6 +393,7 @@
   "framework_gaps": {
     "NIST-800-53-SI-2": [
       "audit-log-integrity",
+      "decompression-dos",
       "kernel-lpe-triage",
       "mail-server-hardening"
     ],
@@ -623,6 +639,7 @@
       "sector-telecom"
     ],
     "AU-ISM-1556": [
+      "decompression-dos",
       "multitenancy-isolation",
       "sector-telecom",
       "self-update-integrity"
@@ -710,6 +727,7 @@
     ],
     "NIS2-Art21-network-security": [
       "audit-log-integrity",
+      "decompression-dos",
       "mail-server-hardening",
       "multitenancy-isolation",
       "network-trust",
@@ -719,6 +737,7 @@
       "network-trust"
     ],
     "UK-CAF-B4": [
+      "decompression-dos",
       "multitenancy-isolation",
       "network-trust",
       "self-update-integrity"
@@ -822,6 +841,7 @@
     "T1059": [
       "ai-attack-surface",
       "attack-surface-pentest",
+      "decompression-dos",
       "mcp-agent-trust",
       "ransomware-response",
       "webapp-security"
@@ -1013,9 +1033,11 @@
       "self-update-integrity"
     ],
     "T1499": [
+      "decompression-dos",
       "multitenancy-isolation"
     ],
     "T1499.001": [
+      "decompression-dos",
       "multitenancy-isolation"
     ]
   },

package/data/cwe-catalog.json

@@ -88,6 +88,7 @@
     "skills_referencing": [
       "api-security",
       "attack-surface-pentest",
+      "decompression-dos",
       "mail-server-hardening",
       "mcp-agent-trust",
       "webapp-security"
@@ -3071,6 +3072,7 @@
     "_auto_imported": true,
     "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
     "skills_referencing": [
+      "decompression-dos",
       "mail-server-hardening",
       "multitenancy-isolation"
     ]
@@ -3780,6 +3782,7 @@
     "_auto_imported": true,
     "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
     "skills_referencing": [
+      "decompression-dos",
       "multitenancy-isolation"
     ]
   },
@@ -3819,7 +3822,10 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "decompression-dos"
+    ]
   },
   "CWE-778": {
     "id": "CWE-778",
@@ -3879,7 +3885,10 @@
     "last_verified": "2026-05-19",
     "notes": "Bulk-imported v0.13.18 from the canonical MITRE Top 25 + commonly-referenced-class expansion.",
     "_auto_imported": true,
-    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated"
+    "_intake_method": "v0.13.18-bulk-mitre-cwe-curated",
+    "skills_referencing": [
+      "decompression-dos"
+    ]
   },
   "CWE-835": {
     "id": "CWE-835",
@@ -4554,5 +4563,43 @@
       "CVE-2023-51765",
       "CVE-2023-51766"
     ]
+  },
+  "CWE-409": {
+    "id": "CWE-409",
+    "name": "Improper Handling of Highly Compressed Data (Data Amplification)",
+    "abstraction": "Base",
+    "category": "Resource Management",
+    "description": "The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. MITRE-canonical; full text at https://cwe.mitre.org/data/definitions/409.html. Backs the decompression-bomb / zip-bomb / nested-archive class (no decompressed-size or ratio cap).",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-197"
+    ],
+    "skills_referencing": [
+      "decompression-dos"
+    ],
+    "evidence_cves": []
+  },
+  "CWE-1333": {
+    "id": "CWE-1333",
+    "name": "Inefficient Regular Expression Complexity",
+    "abstraction": "Base",
+    "category": "Resource Management",
+    "description": "The product uses a regular expression with inefficient, possibly exponential worst-case complexity on a value that can be controlled by an actor, enabling catastrophic backtracking (ReDoS). MITRE-canonical; full text at https://cwe.mitre.org/data/definitions/1333.html.",
+    "top_25_rank_2024": null,
+    "top_25_rank_2025": null,
+    "view_memberships": [
+      "CWE-1000"
+    ],
+    "related_attack_patterns_capec": [
+      "CAPEC-492"
+    ],
+    "skills_referencing": [
+      "decompression-dos"
+    ],
+    "evidence_cves": []
   }
 }

package/data/playbooks/crypto-codebase.json

@@ -57,6 +57,9 @@
         "playbook_id": "secrets",
         "condition": "analyze.classification == 'detected'"
       }
+    ],
+    "fed_by": [
+      "decompression-dos"
     ]
   },
   "domain": {
@@ -959,7 +962,11 @@
             "api_stability_promise_permits_default_change == true OR major_version_bump_planned == true"
           ],
           "priority": 1,
-          "for_signals": ["no-ml-kem-implementation","rsa-1024-anywhere","tls-old-protocol"],
+          "for_signals": [
+            "no-ml-kem-implementation",
+            "rsa-1024-anywhere",
+            "tls-old-protocol"
+          ],
           "compensating_controls": [
             "config_flag_for_classical_only_fallback_with_deprecation_warning",
             "downstream_consumer_migration_guide_published"
@@ -974,7 +981,9 @@
             "downstream_consumer_compat_path_planned == true"
           ],
           "priority": 2,
-          "for_signals": ["ecdsa-without-pqc-roadmap"],
+          "for_signals": [
+            "ecdsa-without-pqc-roadmap"
+          ],
           "compensating_controls": [
             "dual_signature_envelope_during_migration",
             "explicit_algorithm_identifier_in_signed_payload"
@@ -988,7 +997,10 @@
             "weak_hash_call_sites_inventoried == true"
           ],
           "priority": 3,
-          "for_signals": ["weak-hash-import","weak-cipher-mode"],
+          "for_signals": [
+            "weak-hash-import",
+            "weak-cipher-mode"
+          ],
           "compensating_controls": [
             "deprecation_warning_emitted_when_legacy_hash_method_invoked",
             "telemetry_to_track_legacy_method_consumer_usage"
@@ -1003,7 +1015,10 @@
             "performance_regression_acceptable_in_current_release == true"
           ],
           "priority": 4,
-          "for_signals": ["pbkdf2-under-iterated","bcrypt-cost-low"],
+          "for_signals": [
+            "pbkdf2-under-iterated",
+            "bcrypt-cost-low"
+          ],
           "compensating_controls": [
             "kdf_parameter_floor_enforced_at_runtime_not_just_default",
             "consumer_documentation_about_password_rehash_on_login_for_legacy_storage"
@@ -1017,7 +1032,9 @@
             "rng_call_sites_inventoried == true"
           ],
           "priority": 5,
-          "for_signals": ["math-random-in-security-path"],
+          "for_signals": [
+            "math-random-in-security-path"
+          ],
           "compensating_controls": [
             "linter_rule_added_to_ci",
             "data_flow_analysis_for_residual_paths"
@@ -1031,7 +1048,9 @@
             "fips_provider_available_in_target_dep == true"
           ],
           "priority": 6,
-          "for_signals": ["fips-claim-without-runtime-activation"],
+          "for_signals": [
+            "fips-claim-without-runtime-activation"
+          ],
           "compensating_controls": [
             "fips_runtime_assertion_in_init_path",
             "ci_job_running_against_fips_provider_config"
@@ -1045,7 +1064,9 @@
             "vendored_crypto_inventoried == true"
           ],
           "priority": 7,
-          "for_signals": ["vendored-pqc-no-provenance"],
+          "for_signals": [
+            "vendored-pqc-no-provenance"
+          ],
           "compensating_controls": [
             "vendored_copy_pinned_to_release_tag_not_branch",
             "automated_upstream_security_advisory_subscription"
@@ -1059,7 +1080,9 @@
             "api_change_acceptable_in_next_major == true"
           ],
           "priority": 8,
-          "for_signals": ["no-crypto-agility-abstraction"],
+          "for_signals": [
+            "no-crypto-agility-abstraction"
+          ],
           "compensating_controls": [
             "deprecation_path_for_old_api",
             "migration_guide_published"