Fun with Gzip Bombs and Email Clients

A security researcher tested how different email clients handle “gzip bombs”: 10MB compressed files that expand to 10GB when decompressed. The research revealed significant variations in client behavior, with Evolution Mail proving most vulnerable by downloading multiple 10GB files and filling 100GB of disk space, while other clients like Firefox and Thunderbird handled the attack more gracefully. The study highlights critical security lessons about email client image handling and demonstrates potential vulnerabilities in decompression processes, as discussed further on Hacker News. The trick itself is older: Ibrahim Diallo serves the same 10MB-to-10GB file with a Content-Encoding: gzip header to vulnerability scanners and scrapers, and reports that the bots he tracked crash right after ingesting it.