AIKIDO-2026-589831

TL;DR

The component-model validator in wasmparser accepts fixed-length list types without enforcing an upper bound on their declared element count, checking only that the count is non-zero. A crafted component can declare a fixed-length list with an element count as large as 4294967295, which passes validation and then flows into consumers' canonical ABI size calculations. Those oversized counts overflow the downstream size math and lead to denial of service in tools that enable the component-model fixed-length lists feature. The fix caps the accepted element count at 1 GiB (1073741824) during validation.