CVE-2026-104845

A flaw was found in seroval. A remote attacker can cause a Denial of Service (DoS) by providing crafted JSON input containing an excessively large array length during data deserialization. Due to missing bounds validation when reconstructing array structures, the application synchronously allocates excessive memory and processor resources, blocking the event loop and making the service unresponsive.