AIKIDO-2026-11049
dbus-fast is vulnerable to Denial of Service (DoS)
55
Medium Risk
This Affects:
dbus-fastTL;DR
The dbus-fast message unmarshaller reads the body_len and header_len fields directly from an incoming D-Bus header and uses them to size and fill the read buffer before any validation. A peer can forge a header claiming up to roughly four gigabytes of body, forcing the consumer to allocate and buffer that much memory and exhausting host RAM. The fix introduces a 128 MiB MAX_MESSAGE_SIZE constant (matching the D-Bus specification) and rejects messages whose header or body length, individually or combined, exceeds the cap before any allocation occurs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
dbus-fast is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 4.1.0.
How to fix this
Upgrade the dbus-fast library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant