Vsomeip, an automotive communication middleware, had a critical memory allocation vulnerability in versions 3.7.3 and below. This flaw allowed remote attackers to exhaust host memory and cause denial of service. The vulnerability affected reliable TCP endpoints, where the software would grow its receive buffer based on an attacker-declared message size before confirming reception. Without any configured size limits, an attacker could request up to 4 GB of memory per connection. This could lead to a service termination even on memory-constrained systems. The issue was publicly disclosed as COVESA/vsomeip issue #1009. The problem was fixed in vsomeip release 3.7.4, which introduced a default maximum message size of 10 MiB. Deployments unable to upgrade can mitigate by explicitly configuring message size limits. Network segmentation to isolate reliable endpoints from untrusted networks is also recommended. Monitoring for unusual memory growth and connection attempts can help detect exploitation.