GHSA-2226-4v3c-cff8

Suggest an improvement
Source
https://github.com/advisories/GHSA-2226-4v3c-cff8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-2226-4v3c-cff8/GHSA-2226-4v3c-cff8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2226-4v3c-cff8
Aliases
Published
2022-06-17T00:18:24Z
Modified
2023-11-08T04:13:48.926151Z
Summary
Stack overflow in rustc_serialize when parsing deeply nested JSON
Details

When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.

Example code that triggers the vulnerability is

fn main() {
    let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}

serde is recommended as a replacement to rustc_serialize.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-17T00:18:24Z"
}
References

Affected packages

crates.io / rustc-serialize

Package

Name
rustc-serialize
View open source insights on deps.dev
Purl
pkg:cargo/rustc-serialize

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.3.24