CVE-2026-90784: Dvidelabs flatcc Memory Leak DOS Vulnerability

CVE-2026-90784 Overview

CVE-2026-90784 is a memory leak vulnerability in Dvidelabs flatcc versions up to 0.6.3. The flaw resides in the fb_clear_parser function within src/Compiler/semantics.c. The keyword index table allocated during schema parsing is not released when the parser is cleared. Repeated invocations exhaust process memory over time.

The vulnerability is classified as [CWE-401] Missing Release of Memory After Effective Lifetime. Exploitation is possible remotely when flatcc is embedded in services that parse untrusted FlatBuffers schema input. A public exploit disclosure exists, though no in-the-wild exploitation has been reported.

Critical Impact
Repeated schema parsing operations cause unbounded memory growth, degrading availability of applications and services that embed the flatcc compiler library.

Affected Products

Dvidelabs flatcc versions up to and including 0.6.3
Applications and services embedding the flatcc compiler library
FlatBuffers toolchain components relying on fb_clear_parser

Discovery Timeline

2026-09-14 - CVE-2026-90784 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90784

Vulnerability Analysis

The flatcc project is a C-based compiler and runtime for Google's FlatBuffers serialization format. Its parser constructs several internal indexes when reading .fbs schema files, including include tables, attribute indexes, and a keyword index used to detect reserved identifiers during lexical analysis.

When the parser lifecycle ends, fb_clear_parser is expected to release all allocated structures attached to P->schema.root_schema_instance. The pre-patch implementation cleared the include and attribute indexes but omitted the keyword index. Every parser cycle therefore leaked the memory backing that hash table.

In long-running processes that repeatedly parse schemas, such as build servers, code-generation services, or fuzzing harnesses, the leaked allocations accumulate. Sustained input can drive the process toward memory exhaustion and denial of service.

Root Cause

The root cause is a missing cleanup call in src/compiler/parser.c. The fb_name_table_clear routine was invoked for attribute_index but not for keyword_index. Without an explicit release, the internal hash buckets and their string keys remained referenced from freed parser context, orphaning the allocations.

Attack Vector

An attacker who can supply schema content to a service that instantiates and clears the flatcc parser repeatedly can trigger the leak remotely. No authentication or user interaction is required. Impact is limited to availability; confidentiality and integrity are not affected.

     }
     fb_schema_table_clear(&P->schema.root_schema_instance.include_index);
     fb_name_table_clear(&P->schema.root_schema_instance.attribute_index);
+    fb_name_table_clear(&P->schema.root_schema_instance.keyword_index);
     ptr_set_clear(&P->schema.visible_schema);
     if (P->tmp_field_marker) {
         free(P->tmp_field_marker);

Source: GitHub Commit 8dbc3419

Detection Methods for CVE-2026-90784

Indicators of Compromise

Steadily increasing resident set size (RSS) in processes that embed flatcc without corresponding workload growth
Out-of-memory (OOM) terminations of build agents, code-generation workers, or schema validation services
Repeated schema submission requests from a single client to services that parse FlatBuffers definitions

Detection Strategies

Inventory build systems and applications linking against flatcc 0.6.3 or earlier using software composition analysis tooling
Instrument affected services with heap profilers such as Valgrind, AddressSanitizer's LeakSanitizer, or jemalloc statistics to confirm the fb_name_table allocation growth
Correlate schema parsing telemetry with process memory metrics to identify pathological input patterns

Monitoring Recommendations

Configure alerts on abnormal memory growth for any long-running service that ingests user-supplied FlatBuffers schemas
Log the source and size of every parsed schema to support post-incident forensics
Enforce cgroup or container memory limits so leaks trigger controlled restarts rather than host instability

How to Mitigate CVE-2026-90784

Immediate Actions Required

Upgrade flatcc to a version containing commit 8dbc3419738da066151991fd2bf1d0c85591dea2 or later
Rebuild and redistribute any downstream applications that statically link against the vulnerable flatcc library
Restrict schema submission endpoints to authenticated users where feasible until patched builds are deployed

Patch Information

The fix is committed upstream in the flatcc repository. The patch adds a call to fb_name_table_clear for the keyword_index field within fb_clear_parser. Review the GitHub Commit Details and GitHub Issue #389 for full context.

Workarounds

Recycle worker processes on a schedule to reclaim leaked memory until patched binaries are available
Rate-limit schema parsing requests to slow the rate of memory growth
Isolate flatcc-based services in memory-limited containers so exhaustion does not affect neighboring workloads

bash

# Apply the upstream patch directly to a local flatcc checkout
git clone https://github.com/dvidelabs/flatcc.git
cd flatcc
git cherry-pick 8dbc3419738da066151991fd2bf1d0c85591dea2
mkdir -p build && cd build
cmake -DFLATCC_TEST=OFF ..
make -j$(nproc)