A flaw was found in seroval. A remote attacker can cause a Denial of Service (DoS) by providing crafted JSON input containing an excessively large array length during data deserialization. Due to missing bounds validation when reconstructing array structures, the application synchronously allocates excessive memory and processor resources, blocking the event loop and making the service unresponsive.
Last checked: 2026-10-06 18:55 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-06 16:34 UTC)
Fix evidence last checked: 2026-10-02 17:09 UTC