CVE-2023-54404

A flaw was found in zod. A remote attacker can trigger a denial of service (DoS) by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element without a cap or early exit, the application consumes excessive memory and crashes due to an out-of-memory condition.

This vulnerability is evaluated with an Important severity because remote attackers can induce complete service unavailability through process termination without requiring privileged access. Within Red Hat environments, the affected library is embedded into multiple management consoles and microservices that process structured user data. The operational impact depends on whether exposed network endpoints evaluate untrusted collections without preliminary restrictions on payload sizes or element counts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.