Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yMjI2LTR2M2MtY2ZmOM4AArs2

Stack overflow in rustc_serialize when parsing deeply nested JSON

When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.

Example code that triggers the vulnerability is

fn main() {
    let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}

serde is recommended as a replacement to rustc_serialize.

Permalink: https://github.com/advisories/GHSA-2226-4v3c-cff8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yMjI2LTR2M2MtY2ZmOM4AArs2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-2226-4v3c-cff8
References:

• https://github.com/rust-lang-deprecated/rustc-serialize
• https://rustsec.org/advisories/RUSTSEC-2022-0004.html
• https://github.com/advisories/GHSA-2226-4v3c-cff8

Repository: https://github.com/rust-lang-deprecated/rustc-serialize
Blast Radius: 0.0

Affected Packages