CVE-2026-49866: Unbounded Rpc Message Limit Infinity
Setting RPC or network message limits (e.g., maxIhaveMessageIDs, maxMessages) to Infinity removes bounds-checking for excessive input. This unbounded configuration allows an attacker to send oversized payloads that trigger unbounded synchronous iteration or unbounded memory consumption, potentially blocking the event loop and leading to a Denial of Service (
TSgreprules fetch cve-2026-49866-unbounded-rpc-message-limit-infinity --engine opengrepDescription
Setting RPC or network message limits (e.g., maxIhaveMessageIDs, maxMessages) to Infinity removes bounds-checking for excessive input. This unbounded configuration allows an attacker to send oversized payloads that trigger unbounded synchronous iteration or unbounded memory consumption, potentially blocking the event loop and leading to a Denial of Service (
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.