AIKIDO-2026-11050

TL;DR

The recursive D-Bus message unmarshaller in dbus-fast reads variant, struct, array, and dict-entry containers without bounding the call depth. A peer on the bus can pack tens of millions of nested containers into a single message that still fits under the 128 MiB size limit, exhausting the stack before size validation runs and crashing the consuming process. The fix tracks a _container_depth counter across the four container readers and raises InvalidMessageError once nesting exceeds the D-Bus specification limit of 64.