AIKIDO-2026-10223

TL;DR

Affected versions of this package are vulnerable to heap buffer overflow due to integer overflow in hash container resizing logic. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}_hash_{set,map} did not impose an upper bound on their size argument. A very large size value could cause an integer overflow when computing the container’s backing store size, leading to out-of-bounds memory writes and subsequent potential out-of-bounds memory access during container operations. This could be abused to corrupt memory and cause crashes or other unpredictable behavior. The issue is fixed by adding proper bounds checking on size arguments in the affected methods.