GHSA-fpf5-4jw8-67x8 rust-zserio has Unbounded Memory Allocation
An attacker can cause denial of service by providing crafted data with large size values, forcing excessive memory allocation in the rust-zserio library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-fpf5-4jw8-67x8?
GHSA-fpf5-4jw8-67x8 is a denial of service vulnerability in rust-zserio, published on 7 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.
Patches
Please cherry-pick 57f5fb.
Workarounds
- Do not accept
zserio-encoded messages from non-trusted sources. - Allocate a maximum heap amount to
rust-zerioto avoid impacting other applications.
Which versions are affected by GHSA-fpf5-4jw8-67x8?
2 open source packages ship an affected version, including rust-zserio.
| Package | Affected | Fixed in |
|---|---|---|
rust-zserio crates.io | All versions | 0.5.4 |
rust-zserio crates.io | All versions | 0.5.4 |
How do I fix GHSA-fpf5-4jw8-67x8?
Upgrade rust-zserio to 0.5.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-fpf5-4jw8-67x8 being exploited?
There is no known exploitation of GHSA-fpf5-4jw8-67x8 in the wild and no public exploit code.