Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Envelope decryption recovery slots from untrusted metadata are processed without validating against a maximum slot count limit. An attacker can supply a crafted file with numerous recovery slots to cause pre-authentication CPU and memory exhaustion (DoS).
A reader obtained from archive/zip (*File).Open() is decompressed with io.Copy and no cumulative size limit. A crafted zip archive (zip bomb) can inflate to arbitrary size and exhaust disk or memory, causing a denial of service (CWE-405; CVE-2025-53633). Replace io.Copy with io.CopyN inside a loop that accumulates bytes against a maximum-size budget, or wrap
