CVE-2026-73060: Unchecked Collection Multiplication Allocation

Array or collection multiplication capacity is computed directly from 32-bit multiplication without checking for integer overflow or enforcing maximum element/iteration limits. This can lead to integer overflow or denial of service through unbounded memory allocation.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0C#
greprules fetch cve-2026-73060-unchecked-collection-multiplication-allocation --engine opengrep

Description

Array or collection multiplication capacity is computed directly from 32-bit multiplication without checking for integer overflow or enforcing maximum element/iteration limits. This can lead to integer overflow or denial of service through unbounded memory allocation.