CWE-400

{
  "affected": [],
  "aliases": [
    "CVE-2026-48619"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-26T02:16:52Z",
    "severity": "MODERATE"
  },
  "details": "A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",
  "id": "GHSA-v3cq-r2f8-qmmc",
  "modified": "2026-06-26T03:31:29Z",
  "published": "2026-06-26T03:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48619"
    },
    {
      "type": "WEB",
      "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.geronimo:geronimo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-5034"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-15T19:14:56Z",
    "nvd_published_at": "2011-12-30T01:55:00Z",
    "severity": "HIGH"
  },
  "details": "Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.  NOTE: this might overlap CVE-2011-4461.",
  "id": "GHSA-v3h8-rw48-h4gr",
  "modified": "2024-01-15T19:14:56Z",
  "published": "2022-05-13T01:07:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5034"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/geronimo"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r20957aa5962a48328f199e2373f408aeeae601a45dd5275a195e2b6e@%3Cjava-dev.axis.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r360b70489bad65286b49ceb5303a849d2a7ec7d1292774a7259579e1@%3Cissues.karaf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r3c541f019b74902e8e61d73e40ecc2837dfce1b744ad5546919b993c@%3Cissues.karaf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r4fe6b5ff1d48e23337304fd5ac983d89328aecbd1fa198cfc966fbd7@%3Cdev.geronimo.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r653f633aa7b6ccbb8c338dbfcea7a00e4ae9d6f3e064a03cab8dc20d@%3Cjava-dev.axis.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r67747af92035942c9c413bd8394acbb8a1ace5833c0177014c825bc2@%3Cissues.karaf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r8dc1a0ae0e0cf9d2494b8cbd66562f99331c4cf635e7781850a9b9ba@%3Cjava-dev.axis.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra10015f6f3c3c88b7d813383554e87c06347fe163487148669189b8e@%3Cdev.geronimo.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra1fe29f6399b68980f914d8613dee7f67d62a1a97722fe9cd56f4f5f@%3Cdev.geronimo.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb0e85243d7268f1d7a1edb5e6c7df885dbd300acabaaf4cb0e880518@%3Cissues.karaf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rdd67ea3e489134f653349fc2cb09828ac8462aa61dd776b505a3297a@%3Cissues.karaf.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20120105151644/http://www.nruns.com/_downloads/advisory28122011.pdf"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20130213132312/http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/903934"
    },
    {
      "type": "WEB",
      "url": "http://www.ocert.org/advisories/ocert-2011-003.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Apache Geronimo Hash Collisions Cause DoS"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-30635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-13T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver.",
  "id": "GHSA-v3j3-5frm-692p",
  "modified": "2024-04-04T03:27:34Z",
  "published": "2023-04-14T00:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30635"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tikv/tikv/issues/14516"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-2651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:20:14Z",
    "severity": "MODERATE"
  },
  "details": "An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.",
  "id": "GHSA-v3j6-jv37-286j",
  "modified": "2024-05-14T15:32:54Z",
  "published": "2024-05-14T15:32:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2651"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2408619"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/450830"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-54428"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-01T18:16:34Z",
    "severity": "HIGH"
  },
  "details": "Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.",
  "id": "GHSA-v3jc-474w-2wm6",
  "modified": "2026-07-01T21:36:16Z",
  "published": "2026-07-01T18:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-46775"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-28T21:16:31Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).",
  "id": "GHSA-v3pj-p78r-2j24",
  "modified": "2026-05-28T21:32:05Z",
  "published": "2026-05-28T21:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46775"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspumay2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-12243"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-28T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).",
  "id": "GHSA-v3qx-x9jr-g987",
  "modified": "2024-04-04T02:50:23Z",
  "published": "2022-05-24T17:16:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12243"
    },
    {
      "type": "WEB",
      "url": "https://bugs.openldap.org/show_bug.cgi?id=9202"
    },
    {
      "type": "WEB",
      "url": "https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES"
    },
    {
      "type": "WEB",
      "url": "https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20200511-0003"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT211289"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4352-1"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4352-2"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4666"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "paypal-adaptive"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7643"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-25T20:14:36Z",
    "nvd_published_at": "2020-04-23T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.",
  "id": "GHSA-v3r2-3fp4-rp46",
  "modified": "2023-09-06T20:14:32Z",
  "published": "2021-12-10T20:05:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7643"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Ideame/paypal-adaptive-sdk-nodejs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Ideame/paypal-adaptive-sdk-nodejs/blob/master/lib/paypal-adaptive.js#L31"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-PAYPALADAPTIVE-565089"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype pollution in paypal-adaptive"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-2342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-05-30T23:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Triangle MicroWorks SCADA Data Gateway before 3.00.0635 allows remote attackers to cause a denial of service (excessive data processing) via a crafted DNP3 packet.",
  "id": "GHSA-v42f-cq7v-587q",
  "modified": "2025-10-03T00:31:00Z",
  "published": "2022-05-17T04:42:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2342"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-01"
    },
    {
      "type": "WEB",
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01"
    },
    {
      "type": "WEB",
      "url": "http://www.trianglemicroworks.com/products/scada-data-gateway/what%27s-new"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.6b0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "PostQuantum-Feldman-VSS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.7b0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-17T14:48:07Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**Description:**\n\nPostQuantum-Feldman-VSS, a Python library implementing Feldman\u0027s Verifiable Secret Sharing scheme with post-quantum security, was vulnerable to denial-of-service attacks in versions up to and including 0.7.6b0.  This vulnerability stems from the library\u0027s reliance on the `gmpy2` library for arbitrary-precision arithmetic.  `gmpy2`, in turn, depends on the GNU Multiple Precision Arithmetic Library (GMP). GMP, by design, terminates the process when it cannot allocate memory.  An attacker could exploit this by providing carefully crafted inputs that cause `gmpy2` to attempt to allocate extremely large amounts of memory, leading to a crash of the Python interpreter and thus a denial of service.\n\n**Vulnerability Details:**\n\nThe core issue lies in the behavior of GMP (and thus, `gmpy2`) when memory allocation fails.  Instead of raising a standard Python exception that could be caught and handled, GMP terminates the entire process. This behavior is documented in the GMP and gmpy2 documentation:\n\n*   **GMP Memory Management:** [https://gmplib.org/manual/Memory-Management](https://gmplib.org/manual/Memory-Management) (States that the default behavior is to terminate the program.)\n*   **gmpy2 Overview:** [https://gmpy2.readthedocs.io/en/latest/overview.html](https://gmpy2.readthedocs.io/en/latest/overview.html) (Warns that `gmpy2` can crash the interpreter on memory allocation failure.)\n\nSpecific operations within the PostQuantum-Feldman-VSS library that were particularly vulnerable include:\n\n*   **Large Exponentiation (`exp`, `secure_exp`):**  Exponentiation with very large bases or exponents can lead to extremely large results, consuming excessive memory.\n*   **Multi-exponentiation (`efficient_multi_exp`):**  Similar to exponentiation, but with multiple bases and exponents, increasing the risk.\n*   **Matrix Operations (`_secure_matrix_solve`):**  Large matrices used in polynomial reconstruction could lead to significant memory usage.\n*   **Polynomial Evaluation (`_evaluate_polynomial`):** Evaluating polynomials with large coefficients or at large values of `x` could trigger excessive memory allocation.\n\n**Mitigations in 0.8.0b2:**\n\nVersion 0.8.0b2 implements *significant mitigations* to greatly reduce the risk of this denial-of-service vulnerability.  These mitigations **do not** completely eliminate the underlying issue (as that would require changes to GMP itself), but they make successful exploitation *far* more difficult.  The mitigations include:\n\n1.  **Memory Monitoring (`MemoryMonitor` class):**\n    *   A new `MemoryMonitor` class is introduced to track estimated memory usage throughout the library\u0027s operations.\n    *   This class allows setting a maximum memory limit (defaulting to 1024MB, but configurable).\n    *   It provides methods to `check_allocation`, `allocate`, and `release` memory, raising a `MemoryError` if an operation would exceed the configured limit.\n\n2.  **Memory Safety Checks (`check_memory_safety` function):**\n    *   A new `check_memory_safety` function is used to estimate the memory requirements of various `gmpy2` operations *before* they are executed.\n    *   This function considers the operation type (`exp`, `mul`, `pow`, `mod`, `polynomial`, `matrix`, `polynomial_eval`) and the bit lengths of the operands.\n    *   It uses conservative estimates and scaling factors to account for `gmpy2`\u0027s internal overhead.\n    *   If the estimated memory usage exceeds the limit set by the `MemoryMonitor`, the operation is rejected *before* calling `gmpy2`, preventing the crash.\n\n3.  **Integration into Core Classes:**\n    *   The `CyclicGroup` and `FeldmanVSS` classes now use the `check_memory_safety` function before performing potentially memory-intensive operations like `exp`, `mul`, `efficient_multi_exp`, `_evaluate_polynomial`, and `_secure_matrix_solve`.\n\n4.  **Enhanced Input Validation and Error Handling:**\n    *  Added improved input validation in functions.\n    *  Raises custom exceptions like `SecurityError`, `SerializationError`, `VerificationError`, and `ParameterError` that include detailed information for forensics and debugging.\n\n5.  **Safer Defaults and Configuration:**\n    *   The library is configured to use safe primes and large bit lengths by default, reducing the likelihood of accidental misconfiguration leading to excessively large numbers.\n    *   The `VSSConfig` class allows users to customize the `prime_bits` and `cache_size`, enabling them to tailor the library to their specific memory constraints.\n\n**Limitations of Mitigations:**\n\n*   **Estimation Inaccuracy:** The `check_memory_safety` function relies on *estimations* of memory usage. While these estimations are conservative, they are not perfect.  It is still theoretically possible (though much less likely) for an operation to consume more memory than estimated, leading to a crash.\n*   **GMP Behavior:** The fundamental issue of GMP terminating the process on memory allocation failure remains.  The mitigations prevent most common cases, but a sufficiently determined attacker with knowledge of the estimation algorithm *might* still be able to craft an input that triggers a crash.\n*   **Not a Complete Fix:** Version 0.8.0b2 is a *mitigation*, not a complete *elimination* of the vulnerability.\n\n**Workarounds (for versions \u003c= 0.7.6b0):**\n\nIf upgrading to version 0.8.0b2 (or later) is not immediately possible, the following workarounds can help reduce the risk:\n\n*   **Limit Input Sizes:**  Carefully restrict the size of inputs to the library, particularly the bit lengths of secrets, shares, and coefficients, and the threshold value (t).  Avoid using excessively large values.  Use the `check_memory_safety` function (available in 0.8.0b2) to manually check the memory usage.\n*   **Resource Monitoring:** Implement external monitoring of your application\u0027s memory usage.  If memory usage approaches dangerous levels, take action to prevent a crash (e.g., terminate the process, reject new requests, etc.).\n*   **Input Validation:** Thoroughly validate all inputs to the library, ensuring they are within expected ranges and of the correct types.\n*   **Rate Limiting:** Implement rate limiting to prevent an attacker from flooding your system with requests designed to consume excessive memory.\n*  **Custom Memory Allocation**:  *Advanced users* could potentially modify the GMP library to use custom allocation functions that raise Python exceptions instead of terminating the process.  This is a complex and potentially risky approach, and is **not recommended** for most users.  (See [GMP Custom Allocation Documentation](https://gmplib.org/manual/Custom-Allocation)).\n\n**Recommendations:**\n\n*   **Upgrade to 0.8.0b2 (or later) as soon as possible.** This is the *most important* step you can take.\n*   **Configure Memory Limits:**  Use the `MemoryMonitor` in 0.8.0b2 (or later) to set appropriate memory limits for your application.  Consider your system\u0027s available memory and the expected workload.\n*   **Monitor Memory Usage:**  Even with the mitigations, continue to monitor your application\u0027s memory usage and be prepared to handle potential memory exhaustion events.\n*   **Follow Security Best Practices:**  Implement robust input validation, rate limiting, and other security measures to protect your application from various attacks, not just this specific vulnerability.\n\n**Future Work:**\n\n*   **Rust Integration:**  The long-term solution is to implement the most memory-intensive and security-critical operations in a lower-level language like Rust, which provides more control over memory management and can avoid the problematic GMP behavior. This is planned for future versions.\n*   **More Precise Memory Estimation:**  Research and improve the accuracy of the memory estimation algorithms used in `check_memory_safety`.\n*   **Fuzz Testing:**  Conduct extensive fuzz testing to identify any remaining edge cases that could trigger excessive memory allocation.",
  "id": "GHSA-v432-7f47-9g94",
  "modified": "2025-03-19T15:24:59Z",
  "published": "2025-03-17T14:48:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DavidOsipov/PostQuantum-Feldman-VSS/security/advisories/GHSA-v432-7f47-9g94"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DavidOsipov/PostQuantum-Feldman-VSS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PostQuantum-Feldman-VSS\u0027S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash"
}