CVE-2026-74767

Pandora has a DoS in DAA extraction: unbounded decompression of DAA chunks caused memory and CPU exhaustion. The fix uses bounded decompression (decompressobj().decompress()) with max_extracted_filesize, checks cumulative decompressed size, and raises a ZipBomb when the limit is exceeded, abortin...