AIKIDO-2026-850672

TL;DR

The crate decodes TLS-encoded element vectors and byte vectors from input using length-prefixed deserialization. Element-vector decoding does not reject zero-length elements that never advance the read cursor, so a crafted element can drive an infinite loop and unbounded memory growth, while byte-vector decoding eagerly allocates a buffer sized directly from the untrusted length prefix. A malicious peer can supply a small message that hangs the decoder or exhausts available memory. The fix rejects zero-length elements, enforces the declared vector length by measuring actual byte consumption, caps eager allocations, and uses checked arithmetic to avoid length overflow.