A 6-byte packet exhausts memory in Akvorado's BMP server
Akvorado's BMP server sizes its body buffer by subtracting the header size from the length field, in unsigned 32-bit arithmetic. Anything under 6 bytes wraps to about 4 GiB, and eight connections killed the process. CVSS 7.5, GHSA-wr88-h9r3-fqh3.