RUSTSEC-2026-0435 Unbounded memory allocation in `thrift` binary protocol `read_bytes`

Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort denial of service, CWE-400 / CWE-789. This ...