Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
None
Description
in case of MITM server sending super long String value for new BigDecimal(String) and new BigInteger(String) result in java parsing the is O(n²) time, possibly resulting in CPU-exhaustion DoS.
Those string size will be limited as 1024 chars.
(The 1024 cap is comfortably above any legitimate value (MariaDB DECIMAL maxes at 65 digits) keeping worst-case parse time sub-millisecond.
Thanks to tonghuaroot for the report.