GHSA-FPF5-4JW8-67X8: Unbounded Memory Allocation in rust-zserio

Vulnerability ID: GHSA-FPF5-4JW8-67X8

CVSS Score: 7.5

Published: 2026-05-07

A critical vulnerability exists in the rust-zserio crate regarding how auto-generated deserialization routines handle variable-length structures. By supplying a maliciously crafted Zserio bitstream with an artificially inflated size header, an attacker can force the application to request massive memory allocations, resulting in an Out-of-Memory (OOM) panic and process termination.

TL;DR

Unbounded memory allocation in rust-zserio allows remote attackers to trigger an Out-of-Memory crash by providing malformed bitstreams with massive array lengths.

⚠️ Exploit Status: POC

Technical Details

CWE : CWE-770

Attack Vector : Network (Malicious Payload)

Impact : Denial of Service (DoS)

Exploit Status : Proof of Concept (PoC) Available

Authentication Required : None

Remediation : Code Generator Update

Affected Systems

Software leveraging rust-zserio versions prior…