`codeq` is a Rust serialization library with a vulnerability in its `Decode` trait implementations for `String` and `Vec<u8>`. The decoding process reads a 4-byte big-endian length prefix from input and allocates memory of that size before reading the actual payload. Because there is no upper bound or validation on this length, an attacker can supply a small input that causes the library to allocate up to approximately 4 GiB of memory, leading to uncontrolled resource consumption and potential denial of service via out-of-memory conditions. This issue affects all versions prior to 0.6.3. The vulnerability is fixed in version 0.6.3, where the decode buffers grow dynamically as payload bytes arrive instead of pre-allocating the full length.