RUSTSEC-2026-0333 Resource budgets not enforced on the typed deserialization path
Attackers can bypass resource limits in typed deserialization, causing denial of service if custom budgets were configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0333?
RUSTSEC-2026-0333 is a denial of service vulnerability in noyalib, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ParserConfig::max_events, max_nodes, max_total_scalar_bytes,
max_merge_keys, alias_anchor_ratio and the alias jump factor were
enforced only by the two Value loaders. A typed target with a
default-shaped configuration is served by the streaming deserializer,
which never read those fields, so tightening any of them had no effect
on from_str::<T> for a struct target. The default document-length,
depth and alias-count caps were enforced on every path, so no input was
unbounded; the gap affects callers who tightened the other budgets for
hostile input.
Version 0.0.53 charges every budget on the streaming path as well and adds cross-path parity tests.
Users who cannot upgrade can deserialize into noyalib::Value first and
convert with from_value, or rely on max_document_length and
max_depth, which were always applied on every path.
Which versions are affected by RUSTSEC-2026-0333?
1 open source package ship an affected version, including noyalib.
| Package | Affected | Fixed in |
|---|---|---|
noyalib crates.io | From 0.0.0-0 | 0.0.53 |
How do I fix RUSTSEC-2026-0333?
Upgrade noyalib to 0.0.53 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is RUSTSEC-2026-0333 being exploited?
There is no known exploitation of RUSTSEC-2026-0333 in the wild and no public exploit code.
Sources
Also known as GHSA-4xcc-23fx-w2wj.