Reported

May 21, 2022

Issued

June 26, 2022

Package

rulex (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Aliases

• CVE-2022-31099
• GHSA-v78m-2q7v-fjqp

References

• https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp

Patched

• >=0.4.3

Description

When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

The flaw was corrected in commits 60aa2dc03a by adding a check to recursion depth.

Advisory available under CC0-1.0 license.