GHSA-xhj4-g6w8-2xjw go-zserio has Unbounded Memory Allocation for All Platforms
An attacker can cause denial of service by providing crafted data with large size values, forcing excessive memory allocation in the go-zserio library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xhj4-g6w8-2xjw?
GHSA-xhj4-g6w8-2xjw is a denial of service vulnerability in github.com/woven-planet/go-zserio, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory.
Patches
Please apply this commit.
Workarounds
- Do not accept zserio data from non-trusted sources.
- Use secure transportation protocols (like TLS).
Which versions are affected by GHSA-xhj4-g6w8-2xjw?
3 open source packages ship an affected version, including github.com/woven-planet/go-zserio.
| Package | Affected | Fixed in |
|---|---|---|
github.com/woven-planet/go-zserio Go | All versions | 0.9.1 |
github.com/woven-planet/go-zserio Go | All versions | 0.9.1 |
github.com/woven-planet/go-zserio Go | All versions | 0.9.1 |
How do I fix GHSA-xhj4-g6w8-2xjw?
Upgrade github.com/woven-planet/go-zserio to 0.9.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-xhj4-g6w8-2xjw being exploited?
There is no known exploitation of GHSA-xhj4-g6w8-2xjw in the wild and no public exploit code.
Sources
Also known as GO-2026-5759.