Merge pull request #439 from maxmind/greg/stf-1488

Bound decoder resource use to prevent denial of service (STF-1488)

Author: horgh

HISTORY.rst

@@ -3,6 +3,24 @@
 History
 -------
 
+3.2.0
++++++
+
+* Added limits to pure Python record and metadata decoding to prevent denial
+  of service from crafted databases: 65,536 values, 512 nesting levels, and
+  2 MiB of string and bytes payload. Exceeding a limit raises
+  ``InvalidDatabaseError``. CPython may reach its recursion limit earlier,
+  which raises the same error.
+* Rejected unsigned integers longer than 16 bytes and signed integers longer
+  than 4 bytes before reading their payload.
+* Updated the vendored libmaxminddb to 1.14.0, which adds the same resource
+  limits to the C extension.
+* Truncated reads that previously raised ``IndexError`` or ``struct.error``
+  now raise ``InvalidDatabaseError``.
+* The pure Python reader now rejects invalid search tree sizes when opening
+  a database.
+* Improved pure Python lookup performance.
+
 3.1.1 (2026-03-05)
 ++++++++++++++++++
 

README.rst

@@ -94,6 +94,11 @@ The module will return an ``InvalidDatabaseError`` if the database is corrupt
 or otherwise invalid. A ``ValueError`` will be thrown if you look up an
 invalid IP address or an IPv6 address in an IPv4 database.
 
+The reader also raises ``InvalidDatabaseError`` when one record, or the
+database metadata, exceeds its resource limits: 65,536 decoded values, 512
+levels of nesting, or 2 MiB of string and bytes data. Real databases stay far
+below these limits. Python's recursion limit may stop decoding sooner.
+
 Thread Safety
 -------------