PT-2026-95068

Summary The decompression-bomb bound added in 2.0.1 commit 1c1003c sums ZipArchive::statIndex$i'size' and rejects an archive whose declared uncompressed total exceeds system.gpm.archive.max uncompressed size default 1 GiB before extracting ZipArchiver.php:77-86; same logic in GPMInstaller::unZip ...