Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.github.ndsev:zserio-runtime

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5MavenPublished

    Zserio Runtime: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization

    CVE-2026-33524 · GHSA-cwq5-8pvq-j65j

    Affected
    • Maven io.github.ndsev:zserio-runtime <= 2.18.0
    Fixed in
    2.18.1· Vendor fix available
    Issue
    Unbounded Memory Allocation (all platforms) A crafted payload as small as 4-5 bytes can force memory allocations of up to 16 GB, crashing any process with an OOM error (Denial of Service). Affected code (C++): - cpp/runtime/src/zserio/Array.h (line 1029) — mrawArray.reserve(readLength) with unchecked readLength - cpp/runtime/src/zserio/BitStreamReader.h (lines 249, 281) — value.reserve(len) with unchecked len Affected code (Java): - java/runtime/src/zserio/runtime/array/Array.java (line 271) — rawArray.reset(readSize) → new int[readSize] - java/runtime/src/zserio/runtime/io/ByteArrayBitStreamReader.java (line 245) — new byte[length] Proof of Concept Memory Allocation DoS (verified on 64-bit) | Payload | Claimed Size | Allocated | Amplification | |---------|-------------|-----------|---------------| | 4 bytes | 100,000,000 | 762 MB | ~200 million x | | 5 bytes | 2,147,483,647 | ~16 GB | system crash | The full PoC source code and Docker build files are available upon request.…

    Recommended action: Upgrade to 2.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →