Adriank31

Constructed string and indefinite-length ANY decoding repeatedly concatenates fragments onto a growing bytes value. When processing attacker-controlled BER (Basic Encoding Rules) or CER (Canonical Encoding Rules) data containing numerous constructed OCTET STRING or character-string fragments, the system performs quadratic work. Specifically, `OctetStringPayloadDecoder` uses growing header concatenation and `AnyPayloadDecoder.indefLenValueDecoder` uses growing chunk concatenation, repeatedly copying an increasing prefix. This can lead to CPU exhaustion by occupying decoding workers if a sufficiently fragmented value is provided.

Constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. When processing attacker-controlled BER (Basic Encoding Rules) or CER (Canonical Encoding Rules) input containing numerous constructed BIT STRING fragments, or schema-driven DER (Distinguished Encoding Rules) with a definite-length constructed BIT STRING, the `BitStringPayloadDecoder` repeatedly calls `BitString.fromOctetString()`. This process uses the prior `bitString` as a prepend, shifting an ever-growing `SizedInteger` for each fragment, which results in quadratic work. Consequently, large fragmented values can exhaust CPU resources during the `decode()` function execution.

The `interpolateUrl` function inserts unencoded language and namespace values into `loadPath` or `addPath` templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places `lng` or `ns` in the query string and an attacker controls that value, they can perform query-string injection (HTTP parameter pollution). This allows the attacker to add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior by leveraging the application's network position and credentials. Technical details include: - **Vulnerable Parameters:** `lng` and `ns`. - **Vulnerable Function:** `interpolateUrl()`. - **Affected Components:** The issue resides in `lib/utils.js` where the validation logic fails to reject `&` and `=` characters.

An unauthenticated WebSocket client can trigger a memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature. This occurs because the `decompress message data()` function in `compress brotli.py` calls the Brotli decompressor without an output limit and only verifies the `maxMessagePayloadSize` variable after a complete frame has been inflated. Consequently, a small, highly compressed frame can allocate hundreds of MiB of memory before being rejected.

An attacker can craft a malicious PDF file that leads to excessive memory consumption or extended processing times when an application attempts to retrieve the document's form fields.