`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)

codeq is a serialization library whose Decode trait reads length-prefixed values. For String and Vec, the length-prefixed Decode implementations read a 4-byte big-endian length and allocate a buffer of that size before reading the payload. Because the declared length is taken straight from the...

RUSTSEC-2026-0432 `codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)

codeq is a serialization library whose Decode trait reads length-prefixed values. For String and Vec, the length-prefixed Decode implementations read a 4-byte big-endian length and allocate a buffer of that size before reading the payload. Because the declared length is taken straight from the...