Lucene search

K
osvGoogleOSV:RUSTSEC-2022-0030
HistoryMay 21, 2022 - 12:00 p.m.

Stack overflow during recursive expression parsing

2022-05-2112:00:00
Google
osv.dev
13
stack overflow
parsing expressions
untrusted rulex
denial of service
recursion depth
software

EPSS

0.001

Percentile

30.7%

When parsing untrusted rulex expressions, the stack may overflow, possibly
enabling a Denial of Service attack. This happens when parsing an expression
with several hundred levels of nesting, causing the process to abort
immediately.

The flaw was corrected in commits 60aa2dc03a by adding a check to recursion
depth.

EPSS

0.001

Percentile

30.7%

Related for OSV:RUSTSEC-2022-0030