`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)
Affects codeqSource GCVE Database
CVSS 5.3 Medium : upgrade to 0.6.3 when convenient.
Data as of 2 Nov 2026, 12:32 UTC
- Patch
- Available – fixed in 0.6.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LWhat to do
Upgrade codeq to 0.6.3.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iocodeqpkg:cargo/codeqOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to `codeq` version 0.6.3 or later, where the decoding implementation has been fixed to grow buffers dynamically as payload bytes arrive, preventing large upfront allocations from untrusted length prefixes. No other mitigation is required if the upgrade is applied.
Description
`codeq` is a Rust serialization library with a vulnerability in its `Decode` trait implementations for `String` and `Vec<u8>`. The decoding process reads a 4-byte big-endian length prefix from input and allocates memory of that size before reading the actual payload. Because there is no upper bound or validation on this length, an attacker can supply a small input that causes the library to allocate up to approximately 4 GiB of memory, leading to uncontrolled resource consumption and potential denial of service via out-of-memory conditions. This issue affects all versions prior to 0.6.3. The vulnerability is fixed in version 0.6.3, where the decode buffers grow dynamically as payload bytes arrive instead of pre-allocating the full length.