rust-zserio versions prior to 0.5.4 have an unbounded memory allocation vulnerability when deserializing arrays, strings, or byte blobs. The deserialization process trusts the size value read from input data, which can be manipulated to cause excessive memory allocation. This can lead to denial of service by exhausting system memory. A fix is available in version 0.5.4.