Go msgpack nested array DoS bypass maxdepth/maxitems

Vulnerability Summary: Nested Arrays Can Bypass Slow Buffer Length Limits Vulnerability Overview Vulnerability Name: Nested arrays can blow past buffer length limits Vulnerability Type: Denial of Service (DoS) CVSS Score: 5.3 / 10 (Medium) Description: - Attackers can bypass and configuration limits by constructing specific nested arrays, leading to memory exhaustion or stack overflow. - This vulnerability allows attackers to trigger unpredictable memory allocation behaviors, potentially causing service crashes. - Affects all Go applications using , particularly those where and restrictions are not enabled. Impact Scope Affected Versions: - ≤ 5.3.1 - ≤ 4.3.1 Affected Components: - All Go applications using the library for deserialization. - Particularly affects applications that do not set limits for and . Affected Scenarios: - When applications receive and deserialize data from untrusted sources. - When applications do not impose limits on the depth of nested arrays and the number of elements. Remediation Officially Fixed Versions: - ≥ 5.3.2 - ≥ 4.3.2 Temporary Mitigations: - Manually limit the depth and number of elements of nested arrays prior to deserialization. - Use the and configuration parameters to restrict input data. - Perform pre-validation and filtering on data from untrusted sources. POC Code / Exploit Code No complete POC code or exploit code block was provided on the page. It is only mentioned that the vulnerability can be triggered by constructing specific nested arrays, but no specific code examples are given. --- > Note: It is recommended to upgrade to the fixed versions immediately and review existing code to ensure appropriate input limits are implemented.

Goal Reached Thanks to every supporter — we hit 100%!

Go msgpack nested array DoS bypass maxdepth/maxitems

More from this source