Lucene search
+L

2 matches found

RustSec
RustSec
•added 2026/10/06 12:00 p.m.•17 views

Resource budgets not enforced on the typed deserialization path

ParserConfig::maxevents, maxnodes, maxtotalscalarbytes, maxmergekeys, aliasanchorratio and the alias jump factor were enforced only by the two Value loaders. A typed target with a default-shaped configuration is served by the streaming deserializer, which never read those fields, so tightening an...

5.9AI score
SaveExploits0Affected Software1
Rows per page
Query Builder