[cadence 8cbd34256f7ecc46] Version parsing materializes every dot-separated component before checking that there are exactly three. Through parse_manifest, a malformed downloaded manifest can cause la #238

Raised at crates/baley/src/update/version.rs:29 as medium by openai, ruled refuted.

Claim. Version parsing materializes every dot-separated component before checking that there are exactly three. Through parse_manifest, a malformed downloaded manifest can cause large memory amplification and abort the process instead of returning ManifestFault.

Failure scenario. Pass parse_manifest a two-line manifest whose version value contains 32 MiB of periods and whose digest line contains 64 lowercase hex digits. Version::parse allocates over 33 million string slices—more than 512 MiB on a 64-bit target—before rejecting the part count. A memory-constrained update process can be killed despite the input itself fitting comfortably in memory. A bounded split or an early manifest/version length check avoids this failure.

Filed by Cadence. Fingerprint 8cbd34256f7ecc46 over (file, claim).