Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Versions of noyalib before 0.0.53 do not enforce several resource budgets (max_events, max_nodes, max_total_scalar_bytes, max_merge_keys, alias_anchor_ratio and the alias jump factor) when deserializing into a typed struct with from_str. The default document-length, depth and alias-count limits still apply, so input was not unbounded, but callers who tightened these budgets for untrusted input were not protected. Upgrade to noyalib 0.0.53, which applies all budgets on this path; until then, deserialize into noyalib::Value and convert with from_value, which enforces them.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
No source has published a CVSS score for this record yet.
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:24 UTC First seen by agentprime
- 31 Oct 2026, 14:24 UTC Confirmed by OSV