GHSA-fpf5-4jw8-67x8
rust-zserio has Unbounded Memory Allocation
Impact
When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.
Patches
Please cherry-pick 57f5fb.
Workarounds
- Do not accept
zserio-encoded messages from non-trusted sources. - Allocate a maximum heap amount to
rust-zerioto avoid impacting other applications.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
rust-zserio has Unbounded Memory Allocation
Impact
When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.
Patches
Please cherry-pick 57f5fb.
Workarounds
- Do not accept
zserio-encoded messages from non-trusted sources. - Allocate a maximum heap amount to
rust-zerioto avoid impacting other applications.
- Record
GHSA-fpf5-4jw8-67x8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
OSV
rust-zserio has Unbounded Memory Allocation
Impact
When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.
Patches
Please cherry-pick 57f5fb.
Workarounds
- Do not accept
zserio-encoded messages from non-trusted sources. - Allocate a maximum heap amount to
rust-zerioto avoid impacting other applications.
- Record
GHSA-fpf5-4jw8-67x8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rust-zseriocrates.io | through 0.5.3 | 0.5.4 |
rust-zseriocrates.io | before 0.5.4 | 0.5.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-fpf5-4jw8-67x8 is a high vulnerability (CVSS 7.5) in rust-zserio, published May 7, 2026. No source lists public exploit code. Fixed in rust-zserio 0.5.4.