The DER parser used for application-supplied private keys did not safely validate encoded length values before converting them to "Int" values or allocating arrays. A malformed private-key file could encode a length that overflowed or wrapped around, or request an allocation much larger than the available input. This could cause parsing errors or an uncaught "OutOfMemoryError", potentially terminating the application process.