CVE-2025-53633 is a Critical severity resource exhaustion flaw (CVSS 9.8) in Chall-Manager, which starts Challenges on Demand for players. It does not check the size of decoded scenario content, so a zip bomb can be unpacked without limit. The fix is v0.1.4.
What's affected
The advisory says that when Chall-Manager decodes a scenario, which is a zip archive, the size of the decoded content is not checked. Versions before v0.1.4 are affected. Commit 14042aa made the change and it shipped in v0.1.4.
Exploitation needs no authentication or authorisation according to the advisory. The maintainers add that the system should not be reachable by users, because it holds large capabilities and belongs deep within the infrastructure.
The same release also fixed CVE-2025-53632, a path check problem in the same decoder.
How to check if you're exposed
Check which release you run. For Go modules and containers:
go list -m all | grep ctfer-io/chall-manager
docker images | grep -i chall-manager
Anything older than v0.1.4 is affected. Then look at how the service is exposed. List the ingress rules and any proxy that forwards to it, and confirm that players and the public internet cannot send it scenario archives.
Also look at your history. Sudden memory or disk growth on the host, or the process being killed for running out of memory, around the time scenarios were loaded is worth a closer look.
What to do now
- Upgrade Chall-Manager to v0.1.4 or later in every environment.
- Set memory and disk limits on the container or the unit, so a runaway decode stops at a boundary and does not take the host with it.
- Check that the scenario upload path is reachable only from trusted services.
- Review stored scenarios and remove any you cannot account for.
- Alert on unusual memory growth for this service, so the next problem of this kind is seen early.
Why it matters
This is CWE-405, asymmetric resource consumption. A tiny archive can describe an enormous amount of data once it is expanded, because compression ratios can be extreme. A decoder that trusts the archive and writes everything will fill memory or disk.
The usual protection is a budget. Count the bytes as you decode, stop when the total passes a sensible limit, and reject the archive. Also limit the number of entries and the nesting depth. Before v0.1.4 Chall-Manager had no such budget.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not report attacks. The impact is availability, and the score reflects the lack of any login requirement. Correct network placement, as the maintainers recommend, is the main limit on the real risk.
Quick check
What is the real impact of a zip bomb here?
Loss of availability. The service can run out of memory or disk while decoding a scenario, which stops challenges from starting for everyone.
Do I need to upgrade if the service is internal?
Yes, it is still the right step. Internal placement is a good second layer, and the upgrade removes the weakness itself.
Sources
Last reviewed: 18 October 2026.
