GHSA-mcrf-7hf9-f6q5: Unchecked vector pre-allocation

August 25, 2021 (updated June 13, 2023)

Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory.

References

github.com/3Hren/msgpack-rust
github.com/3Hren/msgpack-rust/issues/151
github.com/advisories/GHSA-mcrf-7hf9-f6q5
rustsec.org/advisories/RUSTSEC-2017-0006.html

Code Behaviors & Features

Detect and mitigate GHSA-mcrf-7hf9-f6q5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →