Lucene search

K
rustsecRustsecRUSTSEC-2022-0030
HistoryMay 21, 2022 - 12:00 p.m.

Stack overflow during recursive expression parsing

2022-05-2112:00:00
rustsec.org
11
denial of service
untrusted rulex expressions
recursion depth
software

EPSS

0.001

Percentile

30.7%

When parsing untrusted rulex expressions, the stack may overflow, possibly
enabling a Denial of Service attack. This happens when parsing an expression
with several hundred levels of nesting, causing the process to abort
immediately.

The flaw was corrected in commits 60aa2dc03a by adding a check to recursion
depth.

EPSS

0.001

Percentile

30.7%

Related for RUSTSEC-2022-0030