Details
Description
in case of MITM server sending super long String value for new BigDecimal(String) and new BigInteger(String) result in java parsing the is O(n²) time, possibly resulting in CPU-exhaustion DoS.
Those string size will be limited as 1024 chars.
(The 1024 cap is comfortably above any legitimate value (MariaDB DECIMAL maxes at 65 digits) keeping worst-case parse time sub-millisecond.
Thanks to tonghuaroot for the report.