# Unbounded allocation from declared input

Caller-declared sizes, counts, depths or codecs driving allocation or CPU with no server-side cap

_Area: Web business logic and race conditions. Seen in 20 disclosed reports; 5 confirmed bounties, median $500, range $150-$4,000; latest 2026-10-22. Updated 2026-10-23._

## How it works
Code takes a value from the caller or peer — a charset name, a repetition count, a part count, a nesting depth, a declared uncompressed size, a share count — and does work proportional to it without a ceiling. The broken assumption is that the declared value reflects the real cost. A few bytes can declare gigabytes of allocation or force superlinear CPU. The unifying theme is cost amplification: attacker input is tiny, server cost is huge. Defenses often cap one resource while the attacker amplifies another at zero cost of the capped one [E2](https://bugbountylibrary.com/r/h1%3A1518036.md), gate the cap on an attacker-controlled field that can be zeroed [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-rcw4-f5rp-g42v.md), or fix one code path while a sibling stays open [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md).

## Where it shows up
- Client-supplied charset passed to `codecs.getreader`, which accepts byte-transform codecs (bz2, zlib, base64) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3547-9m27-7rxg.md)
- Regex constructs with large or nested repetitions over empty sub-expressions, driving compile-time CPU [E2](https://bugbountylibrary.com/r/h1%3A1518036.md)
- Multipart bodies with many small parts, where parse cost grows faster than part count [E3](https://bugbountylibrary.com/r/h1%3A431561.md)
- HTTP client response sinks that decompress before counting bytes, with no max-body cap [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md)
- Client-supplied object structures whose nesting depth exceeds what the serializer can recurse [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md)
- Decompression caps gated on a declared size field that the attacker can set to 0 [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-rcw4-f5rp-g42v.md)
- Markdown/autolink parsers scanning long runs of unterminated `[` or `![` openers [E7](https://bugbountylibrary.com/r/h1%3A1619604.md)
- Recommendation/autocomplete endpoints fanning out over user-created graphs (circles × folders) [E8](https://bugbountylibrary.com/r/h1%3A1688199.md)

## How to review
Find every place a caller- or peer-declared count, size, depth, part count, or encoding name drives allocation or iteration. The invariant: work and memory must be bounded by a constant or a server-enforced cap, never by the input value. Check caps on range expansion before materializing [E8](https://bugbountylibrary.com/r/h1%3A1688199.md), on quantifier depth and nesting [E2](https://bugbountylibrary.com/r/h1%3A1518036.md), on part count as well as byte size [E3](https://bugbountylibrary.com/r/h1%3A431561.md), and on multiplicative combinations an attacker can cheaply create [E8](https://bugbountylibrary.com/r/h1%3A1688199.md). For encoding names, confirm only text codecs are accepted — `codecs.getreader` is the entry point that ignores `_is_text_encoding` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3547-9m27-7rxg.md). For response sinks, confirm the limit counts decompressed bytes in the write callback, not just the wire size [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md). For serializers, confirm parse and serialize accept the same depth, or guard the re-serialization [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md). For any cap derived from a declared field, test boundary values (0, negative, max) that make the guard falsy — a conditional cap is no cap [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-rcw4-f5rp-g42v.md). Ask: can cost grow faster than input size, and does any existing cap cover the resource actually consumed?

## Variants seen
- Memory cap bypassed by zero-byte empty-subexpression repetition forcing CPU blowup [E2](https://bugbountylibrary.com/r/h1%3A1518036.md)
- Superlinear multipart parsing on many small parts (10,000 parts → 15-25s) [E3](https://bugbountylibrary.com/r/h1%3A431561.md)
- Polynomial-time autolink parsing on crafted markdown, unauthenticated [E7](https://bugbountylibrary.com/r/h1%3A1619604.md)
- Unbounded loop over circle×folder combinations exhausting DB/CPU [E8](https://bugbountylibrary.com/r/h1%3A1688199.md)
- Attacker-named decompression codec inflating a tiny body past the upload cap [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3547-9m27-7rxg.md)
- Decompression bomb through a sibling HTTP client with no response-size gate [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md)
- Deeply nested pattern object crashing the process via serializer RangeError [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md)
- Decompression cap skipped when declared uncompressed size is 0 [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-rcw4-f5rp-g42v.md)

## Why fixes fail
A fix in one backend leaves sibling code paths ungated [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md). A memory-based cap is bypassed by inputs that consume zero of the capped resource [E2](https://bugbountylibrary.com/r/h1%3A1518036.md). A cap derived from an attacker-controlled header is disabled by setting that header to 0 [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-rcw4-f5rp-g42v.md).

## Impact and severity
Full service DoS, often unauthenticated [E3](https://bugbountylibrary.com/r/h1%3A431561.md)[E7](https://bugbountylibrary.com/r/h1%3A1619604.md), sometimes needing only a logged-in account [E8](https://bugbountylibrary.com/r/h1%3A1688199.md). Severity rises when input is tiny relative to damage (108 bytes → 50MB [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-3547-9m27-7rxg.md); ~4MB gzip → 4GiB OOM in ~3s [E4](https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md)) and when the sink is shared, so one request blocks all users [E5](https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-3547-9m27-7rxg.md
- E2: https://bugbountylibrary.com/r/h1%3A1518036.md
- E3: https://bugbountylibrary.com/r/h1%3A431561.md
- E4: https://bugbountylibrary.com/r/ghsa%3AGHSA-chx6-46f5-w4vp.md
- E5: https://bugbountylibrary.com/r/ghsa%3AGHSA-m8vh-jmq9-5rjg.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-rcw4-f5rp-g42v.md
- E7: https://bugbountylibrary.com/r/h1%3A1619604.md
- E8: https://bugbountylibrary.com/r/h1%3A1688199.md