# Unbounded allocation and decompression DoS

Peer-declared sizes, counts, compressed data, or per-request state driving memory or loops without a hard cap

_Area: Network devices and IoT. Seen in 5 disclosed reports; 2 confirmed bounties: $500 and $50,000; latest 2025-04-27. Updated 2026-10-23._

## How it works
A handler trusts something the peer controls: a length prefix, a list of IDs, a compressed chunk, or a unique session identifier. It then allocates, reads, loops, or persists state in proportion to that input with no ceiling. Memory, CPU, or disk scales with attacker input, so one request (or many cheap ones) exhausts the process or device. The broken assumption is that declared sizes, structures, and request volume are bounded and well-formed.

## Where it shows up
- Length prefixes passed straight into a single read/allocation, e.g. `IO#read(N)` on a literal `{N}` [E5](https://bugbountylibrary.com/r/h1%3A3108869.md)
- RPC handlers that flatten client-supplied ID lists into one response vector [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md)
- Decompression of negotiated streams or chunks with no output cap [E3](https://bugbountylibrary.com/r/h1%3A5928.md)
- Compression negotiated before authentication [E3](https://bugbountylibrary.com/r/h1%3A5928.md)
- Middleware that writes one file per unique session id with no eviction or total cap [E4](https://bugbountylibrary.com/r/h1%3A406614.md)
- Retry/realloc loops whose length-tracking variable is not updated on the error path [E2](https://bugbountylibrary.com/r/h1%3A113424.md)

## How to review
Find every place a peer-declared size, count, structure, or identifier drives allocation, reading, looping, or persisted state. The invariant: a hard cap and timeout must apply before allocation or iteration, independent of the declared value. Check that decompressed output is bounded, not just input [E3](https://bugbountylibrary.com/r/h1%3A5928.md). Check that list handlers cap both item count and total serialized size [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md). Check negotiation ordering: if compression is accepted pre-auth, the DoS is unauthenticated [E3](https://bugbountylibrary.com/r/h1%3A5928.md). For clients, confirm declared sizes are capped before allocating; here the peer is the server, so the client is the victim [E5](https://bugbountylibrary.com/r/h1%3A3108869.md). For session middleware, confirm a cap on total entries and eviction of stale ones [E4](https://bugbountylibrary.com/r/h1%3A406614.md). For retry loops, confirm every error path writes back the required size so the loop terminates [E2](https://bugbountylibrary.com/r/h1%3A113424.md).

## Variants seen
- Unbounded ID list flattened into response; 37MB request with 1.2M digests OOMs validators, ~41KB per certificate amplifies memory [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md)
- zlib stanza decompression expands 4MB to 4GB with no output limit [E3](https://bugbountylibrary.com/r/h1%3A5928.md)
- Client allocates server-declared IMAP literal size up front [E5](https://bugbountylibrary.com/r/h1%3A3108869.md)
- One cache file per unique session cookie fills tmpfs until the portal hangs [E4](https://bugbountylibrary.com/r/h1%3A406614.md)
- Infinite realloc loop when the too-long branch omits the size write-back [E2](https://bugbountylibrary.com/r/h1%3A113424.md)

## Impact and severity
Ranged from single-service crash to total network shutdown [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md), unauthenticated memory/CPU exhaustion [E3](https://bugbountylibrary.com/r/h1%3A5928.md), client memory exhaustion [E5](https://bugbountylibrary.com/r/h1%3A3108869.md), and device-wide hang [E4](https://bugbountylibrary.com/r/h1%3A406614.md). Severity rises when the path is pre-auth [E3](https://bugbountylibrary.com/r/h1%3A5928.md), on consensus/critical nodes [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md), or when cheap repeated requests accumulate state [E4](https://bugbountylibrary.com/r/h1%3A406614.md). Amplification ratio (per-item size times count) and lack of timeouts made it worse [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sui-network-shutdown.md
- E2: https://bugbountylibrary.com/r/h1%3A113424.md
- E3: https://bugbountylibrary.com/r/h1%3A5928.md
- E4: https://bugbountylibrary.com/r/h1%3A406614.md
- E5: https://bugbountylibrary.com/r/h1%3A3108869.md