Zserio DoS: Crafted Payload Triggers Massive Memory Allocation

The National Vulnerability Database has disclosed CVE-2026-33524, affecting Zserio, a data serialization framework. This vulnerability allows an unauthenticated attacker to trigger a denial of service (DoS) by sending a small, crafted payload. National Vulnerability Database analysis indicates that a mere 4-5 bytes can force Zserio to allocate up to 16 GB of memory, inevitably causing an Out-Of-Memory (OOM) error and crashing the process.

This high-severity flaw, rated 7.5 CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), stems from improper resource management (CWE-789). While specific affected products are not detailed, any system leveraging Zserio prior to version 2.18.1 is vulnerable. The simplicity of the attack — a small, unauthenticated network-based payload — makes it a critical concern for defenders, as it requires minimal attacker sophistication to achieve a full system crash.

Organizations running Zserio in their infrastructure must prioritize patching to version 2.18.1 immediately. The attacker’s calculus here is straightforward: cheap, effective disruption. This isn’t about data exfiltration; it’s about taking systems offline with minimal effort, which can be devastating for critical services. Defending against such a low-effort attack demands rapid remediation.