{"id":"GHSA-mcrf-7hf9-f6q5","aliases":["RUSTSEC-2017-0006"],"status":"published","title":"Unchecked vector pre-allocation","description":"Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2017-11-21T12:00:00Z","modified":"2023-11-08T04:21:02Z","fixes":[{"ecosystem":"crates.io","package":"rmpv","fixed_in":["0.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rmpv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rmpv","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rmpv","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.2"}]}]}],"references":[{"url":"https://github.com/3Hren/msgpack-rust/issues/151","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2017-0006.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mcrf-7hf9-f6q5"},{"url":"https://github.com/3Hren/msgpack-rust","tags":["package"]},{"url":"https://crates.io/crates/rmpv","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-mcrf-7hf9-f6q5","title":"Unchecked vector pre-allocation","description":"Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory.\n","status":"published","published":"2021-08-25T21:00:09Z","modified":"2023-06-13T20:48:56Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"osv":[{"id":"GHSA-mcrf-7hf9-f6q5","title":"Unchecked vector pre-allocation","description":"Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory.\n","status":"published","published":"2021-08-25T21:00:09Z","modified":"2023-11-08T04:21:02.280202Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"RUSTSEC-2017-0006","title":"Unchecked vector pre-allocation","description":"Affected versions of this crate pre-allocate memory on deserializing raw\nbuffers without checking whether there is sufficient data available.\n\nThis allows an attacker to do denial-of-service attacks by sending small\nmsgpack messages that allocate gigabytes of memory.","status":"published","published":"2017-11-21T12:00:00Z","modified":"2023-11-08T04:21:02.280202Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}