Intel

AIKIDO-2026-10055

qs-codec is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.

25

Low Risk

This Affects:

PYTHONqs-codec
0.0.1 - 1.3.2
Fixed in 1.3.3

TL;DR

Affected versions of the package are vulnerable to denial-of-service conditions due to unbounded list growth during query string decoding. When decoding crafted inputs with excessive parameters, lists can grow without limit, leading to excessive memory consumption. The fix introduces controlled overflow handling by converting oversized lists into a bounded overflow structure, ensuring memory safety and preventing resource exhaustion during parsing.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

qs-codec is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.3.2.

How to fix this

Upgrade the qs-codec library to the patch version.