Advisories for Golang/Github.com/VictoriaMetrics/VictoriaMetrics package

The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside the intended -storageDataPath restore root, subject to the permissions of the vmrestore process.

Affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits.