GHSA-xhj4-g6w8-2xjw: go-zserio has Unbounded Memory Allocation for All Platforms
When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.
References
Code Behaviors & Features
Detect and mitigate GHSA-xhj4-g6w8-2xjw with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →