7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-fpf5-4jw8-67x8

GHSA-fpf5-4jw8-67x8: rust-zserio has Unbounded Memory Allocation

Impact

When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.

Patches

Please cherry-pick 57f5fb.

Workarounds

Do not accept zserio-encoded messages from non-trusted sources.
Allocate a maximum heap amount to rust-zerio to avoid impacting other applications.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-fpf5-4jw8-67x8

GHSA-fpf5-4jw8-67x8:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rust-zserio	rust	<= 0.5.3	0.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unbounded memory allocation in rust-zserio when deserializing data from an untrusted source. The root cause is that the size or length of data structures like strings, byte arrays (blobs), and arrays is read from the data stream and used for memory allocation without proper validation. An attacker can craft a malicious zserio stream with a large length value for a string, blob, or array, causing the deserializer to attempt a huge memory allocation, which can lead to a denial of service (DoS) by exhausting system memory.

The vulnerability manifests in three places:

String deserialization: The zserio::ztype::string_decode::read_string function reads the string length and allocates a buffer of that size. The patch adds a check to ensure the claimed length does not exceed the available data in the stream.
Blob/bytes deserialization: The zserio::ztype::reader::read_bytes function is responsible for reading byte arrays. The patch ensures that the requested number of bytes is not larger than the available data before allocation.
Array deserialization: For arrays, the vulnerability was in the code generated by the zserio-rs-build crate. The decode_field function was generating code that allocated the entire array at once using the untrusted length from the stream (vec![...; length]). The patch modifies the code generator to produce code that uses a safer, push-based deserialization for arrays. It also introduces a new zserio::ztype::array::Array::zserio_read implementation that caps the initial memory reservation to a reasonable chunk size (ARRAY_ALLOC_CHUNK), preventing a single large allocation.

The fix involves consistently checking the claimed data size against the available data in the input stream before performing memory allocations. For arrays, the allocation strategy was changed to be incremental rather than a single large block.

Vulnerable functions

zserio::ztype::string_decode::read_string

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.