Azure
diff --git a/‎Microsoft.Azure.Cosmos.Encryption.Custom/src/ArrayPoolManager.cs‎
Lines changed: 23 additions & 1 deletion b/‎Microsoft.Azure.Cosmos.Encryption.Custom/src/ArrayPoolManager.cs‎
Lines changed: 23 additions & 1 deletion
diff --git a/‎Microsoft.Azure.Cosmos.Encryption.Custom/src/Common/PooledJsonSerializer.cs‎
Lines changed: 230 additions & 0 deletions b/‎Microsoft.Azure.Cosmos.Encryption.Custom/src/Common/PooledJsonSerializer.cs‎
Lines changed: 230 additions & 0 deletions
@@ -12,9 +12,23 @@ namespace Microsoft.Azure.Cosmos.Encryption.Custom
     internal class ArrayPoolManager<T> : IDisposable
 #pragma warning restore SA1402 // File may only contain a single type
     {
-        private List<T[]> rentedBuffers = new ();
+        // Covers the typical decrypt rent count (~2 per encrypted property + structural)
+        // so the List<T[]> does not grow through 4/8/16/.../256 on every op.
+        private const int DefaultRentCapacity = 16;
+
+        private List<T[]> rentedBuffers;
         private bool disposedValue;
 
+        public ArrayPoolManager()
+            : this(DefaultRentCapacity)
+        {
+        }
+
+        public ArrayPoolManager(int initialRentCapacity)
+        {
+            this.rentedBuffers = new List<T[]>(initialRentCapacity <= 0 ? DefaultRentCapacity : initialRentCapacity);
+        }
+
         public T[] Rent(int minimumLength)
         {
             T[] buffer = ArrayPool<T>.Shared.Rent(minimumLength);
@@ -50,5 +64,13 @@ public void Dispose()
 
     internal class ArrayPoolManager : ArrayPoolManager<byte>
     {
+        public ArrayPoolManager()
+        {
+        }
+
+        public ArrayPoolManager(int initialRentCapacity)
+            : base(initialRentCapacity)
+        {
+        }
     }
 }
@@ -0,0 +1,230 @@
+//------------------------------------------------------------
+// Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------
+
+#if NET8_0_OR_GREATER
+namespace Microsoft.Azure.Cosmos.Encryption.Custom
+{
+    using System;
+    using System.Buffers;
+    using System.IO;
+    using System.Text.Json;
+    using System.Threading;
+    using System.Threading.Tasks;
+
+    /// <summary>
+    /// Provides optimized System.Text.Json serialization/deserialization using ArrayPool-backed buffers.
+    /// </summary>
+    /// <remarks>
+    /// <para><strong>Thread Safety:</strong></para>
+    /// <para>
+    /// All methods are thread-safe and can be called concurrently from multiple threads. Each invocation
+    /// creates independent PooledMemoryStream instances, and JsonSerializer.Serialize/Deserialize are
+    /// thread-safe when using separate stream instances.
+    /// </para>
+    /// <para><strong>Disposal Requirements:</strong></para>
+    /// <para>
+    /// Methods returning PooledMemoryStream transfer ownership to the caller. The caller MUST dispose
+    /// the returned stream to prevent memory leaks. Methods accepting Stream parameters do NOT dispose
+    /// the input stream - disposal remains the caller's responsibility.
+    /// </para>
+    /// <para><strong>Performance Considerations:</strong></para>
+    /// <para>
+    /// Uses ArrayPool-backed buffers configured via PooledStreamConfiguration. Reduces GC pressure
+    /// compared to standard MemoryStream. Deserialization reads directly from input streams without
+    /// intermediate buffering when possible.
+    /// </para>
+    /// </remarks>
+    internal static class PooledJsonSerializer
+    {
+        /// <summary>
+        /// Default JSON serialization options with security hardening.
+        /// </summary>
+        /// <remarks>
+        /// MaxDepth is set to 64 to protect against Denial of Service (DoS) attacks from deeply nested JSON structures.
+        /// This prevents stack overflow and excessive memory consumption. See: https://github.com/advisories/GHSA-5crp-9r3c-p9vr
+        /// </remarks>
+        private static readonly JsonSerializerOptions DefaultOptions = CreateDefaultOptions();
+
+        /// <summary>
+        /// Gets the shared default <see cref="JsonSerializerOptions"/> instance used by the
+        /// streaming encryption path.
+        /// </summary>
+        public static JsonSerializerOptions SerializerOptions => DefaultOptions;
+
+        private static JsonSerializerOptions CreateDefaultOptions()
+        {
+            JsonSerializerOptions options = new ()
+            {
+                DefaultIgnoreCondition = System.Text.Json.Serialization.JsonIgnoreCondition.WhenWritingNull,
+                MaxDepth = 64,
+            };
+            options.MakeReadOnly(populateMissingResolver: true);
+            return options;
+        }
+
+        /// <summary>
+        /// Serializes an object to a PooledMemoryStream using ArrayPool-backed buffers.
+        /// </summary>
+        public static PooledMemoryStream SerializeToPooledStream<T>(T value, JsonSerializerOptions options = null)
+        {
+            // Always clear buffers for security - this is an encryption library handling sensitive data
+            PooledMemoryStream stream = new (
+                capacity: PooledStreamConfiguration.Current.StreamInitialCapacity,
+                clearOnReturn: true);
+
+            try
+            {
+                using (Utf8JsonWriter writer = new (stream, new JsonWriterOptions { SkipValidation = false }))
+                {
+                    JsonSerializer.Serialize(writer, value, options ?? DefaultOptions);
+                    writer.Flush();
+                }
+
+                stream.Position = 0;
+                return stream;
+            }
+            catch
+            {
+                stream.Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// Serializes an object directly to a stream using Utf8JsonWriter with minimal allocations.
+        /// </summary>
+        public static void SerializeToStream<T>(Stream stream, T value, JsonSerializerOptions options = null)
+        {
+            if (stream == null)
+            {
+                throw new ArgumentNullException(nameof(stream));
+            }
+
+            using (Utf8JsonWriter writer = new (stream, new JsonWriterOptions { SkipValidation = false }))
+            {
+                JsonSerializer.Serialize(writer, value, options ?? DefaultOptions);
+                writer.Flush();
+            }
+        }
+
+        /// <summary>
+        /// Serializes an object directly to a stream asynchronously using Utf8JsonWriter with minimal allocations.
+        /// </summary>
+        public static async Task SerializeToStreamAsync<T>(Stream stream, T value, JsonSerializerOptions options = null, CancellationToken cancellationToken = default)
+        {
+            if (stream == null)
+            {
+                throw new ArgumentNullException(nameof(stream));
+            }
+
+            await JsonSerializer.SerializeAsync(stream, value, options ?? DefaultOptions, cancellationToken);
+        }
+
+        /// <summary>
+        /// Serializes an object to a RentArrayBufferWriter using ArrayPool-backed buffers.
+        /// Returns the buffer writer which must be disposed by the caller.
+        /// </summary>
+        public static RentArrayBufferWriter SerializeToBufferWriter<T>(T value, JsonSerializerOptions options = null)
+        {
+            RentArrayBufferWriter bufferWriter = new (PooledStreamConfiguration.Current.BufferWriterInitialCapacity);
+
+            try
+            {
+                using (Utf8JsonWriter writer = new (bufferWriter, new JsonWriterOptions { SkipValidation = false }))
+                {
+                    JsonSerializer.Serialize(writer, value, options ?? DefaultOptions);
+                    writer.Flush();
+                }
+
+                return bufferWriter;
+            }
+            catch
+            {
+                bufferWriter.Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>
+        /// Deserializes from a stream using System.Text.Json with minimal allocations.
+        /// </summary>
+        public static T DeserializeFromStream<T>(Stream stream, JsonSerializerOptions options = null)
+        {
+            if (stream == null)
+            {
+                throw new ArgumentNullException(nameof(stream));
+            }
+
+            return JsonSerializer.Deserialize<T>(stream, options ?? DefaultOptions);
+        }
+
+        /// <summary>
+        /// Deserializes from a stream asynchronously using System.Text.Json with minimal allocations.
+        /// </summary>
+        public static async ValueTask<T> DeserializeFromStreamAsync<T>(Stream stream, JsonSerializerOptions options = null, CancellationToken cancellationToken = default)
+        {
+            if (stream == null)
+            {
+                throw new ArgumentNullException(nameof(stream));
+            }
+
+            return await JsonSerializer.DeserializeAsync<T>(stream, options ?? DefaultOptions, cancellationToken);
+        }
+
+        /// <summary>
+        /// Deserializes from a byte span using Utf8JsonReader with zero allocations.
+        /// </summary>
+        public static T DeserializeFromSpan<T>(ReadOnlySpan<byte> utf8Json, JsonSerializerOptions options = null)
+        {
+            Utf8JsonReader reader = new (utf8Json);
+            return JsonSerializer.Deserialize<T>(ref reader, options ?? DefaultOptions);
+        }
+
+        /// <summary>
+        /// Serializes an object to a pooled byte array.
+        /// Returns the rented array and the actual length written.
+        /// </summary>
+        /// <remarks>
+        /// <para><strong>CRITICAL - Caller Responsibility:</strong></para>
+        /// <para>
+        /// The returned byte array is rented from ArrayPool.Shared and MUST be returned by the caller
+        /// using ArrayPool&lt;byte&gt;.Shared.Return(buffer, clearArray: true) to prevent memory leaks.
+        /// Since this is an encryption library handling sensitive data, always use clearArray: true
+        /// when returning the buffer.
+        /// </para>
+        /// <para><strong>Exception Safety:</strong></para>
+        /// <para>
+        /// If this method throws an exception, all rented resources are automatically cleaned up.
+        /// The caller is only responsible for returning the buffer if the method succeeds.
+        /// </para>
+        /// </remarks>
+        public static (byte[] Buffer, int Length) SerializeToPooledArray<T>(T value, JsonSerializerOptions options = null)
+        {
+            using RentArrayBufferWriter bufferWriter = new ();
+            using (Utf8JsonWriter writer = new (bufferWriter, new JsonWriterOptions { SkipValidation = false }))
+            {
+                JsonSerializer.Serialize(writer, value, options ?? DefaultOptions);
+                writer.Flush();
+            }
+
+            (byte[] buffer, int length) = bufferWriter.WrittenBuffer;
+
+            // Copy to a separate rented buffer since bufferWriter will be disposed
+            byte[] result = ArrayPool<byte>.Shared.Rent(length);
+            try
+            {
+                Buffer.BlockCopy(buffer, 0, result, 0, length);
+                return (result, length);
+            }
+            catch
+            {
+                // Critical: Return the rented buffer to prevent memory leak if BlockCopy throws.
+                // Use clearArray: true for security since this is an encryption library handling sensitive data.
+                ArrayPool<byte>.Shared.Return(result, clearArray: true);
+                throw;
+            }
+        }
+    }
+}
+#endif