7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33524

CVE-2026-33524: Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

Zserio is a framework for serializing structured data with a compact and efficient way with low overhead. Prior to 2.18.1, a crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). This vulnerability is fixed in 2.18.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33524

CVE-2026-33524:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.github.ndsev:zserio-runtime	maven	<= 2.18.0	2.18.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unbounded memory allocation issue in the Zserio Java runtime library. Several functions responsible for deserializing data from a bitstream are affected. These functions read a size or length value from the stream and directly use it to allocate memory for arrays or buffers without proper validation. An attacker can craft a malicious payload with a large size value in just a few bytes, tricking the deserializer into attempting a massive memory allocation (e.g., up to 16 GB). This leads to an Out-Of-Memory (OOM) error, causing a Denial of Service (DoS) by crashing the application. The provided patch addresses this by adding checks in the vulnerable functions. Before allocating memory, the patched code now verifies if the requested size is consistent with the number of bytes remaining in the input stream. If the claimed size exceeds the available data, an IOException is thrown, preventing the excessive memory allocation.

Vulnerable functions

zserio.runtime.array.Array.read

compiler/extensions/java/runtime/src/zserio/runtime/array/Array.java

The function reads a size `readSize` from the bitstream and uses it to allocate an array via `rawArray.reset(readSize)`. A malicious stream can provide a large `readSize` value, causing an out-of-memory error. The patch adds a check to validate the size against the remaining bits in the stream before allocation.

zserio.runtime.io.ByteArrayBitStreamReader.readBytes

compiler/extensions/java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java

The function reads a length from the bitstream and uses it to allocate a byte array `new byte[length]`. A malicious stream can provide a large length value, causing an out-of-memory error. The patch adds a check to validate the length against the remaining bits in the stream before allocation.

zserio.runtime.io.ByteArrayBitStreamReader.readString

compiler/extensions/java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java

The function reads a length from the bitstream and uses it to allocate a byte array for the string `new byte[length]`. A malicious stream can provide a large length value, causing an out-of-memory error. The patch adds a check to validate the length against the remaining bits in the stream before allocation.

zserio.runtime.io.ByteArrayBitStreamReader.readBitBuffer

compiler/extensions/java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java

The function reads a `bitSize` from the bitstream and uses it to create a `BitBuffer`, which involves allocating memory proportional to `bitSize`. A malicious stream can provide a large `bitSize` value, causing an out-of-memory error. The patch adds a check to validate the `bitSize` against the remaining bits in the stream before allocation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.