Endlssnightmare

An unbounded memory allocation issue exists where attackers can exhaust JVM memory by declaring a large uncompressed length in compressed input. By providing crafted bytes to the `uncompress()`, `uncompressString()`, `SnappyInputStream`, or `SnappyFramedInputStream` functions, an attacker can force allocations up to 2 GB, leading to an OutOfMemoryError and a denial of service.

The REST API fails to properly enforce the scope of project- and workspace-scoped teams. This allows a user to submit invalid team configurations, enabling them to assign projects to a team via unvalidated requests. Consequently, a user could grant themselves access to projects they are not authorized to see or manage, potentially exposing private projects and allowing unauthorized translation, repository, and project-management operations.