{"id":"GHSA-2226-4v3c-cff8","aliases":["RUSTSEC-2022-0004"],"url":"https://o3.security/vulnerability/GHSA-2226-4v3c-cff8","summary":"Stack overflow in rustc_serialize when parsing deeply nested JSON","details":"When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.\n\nExample code that triggers the vulnerability is\n\n```rust\nfn main() {\n    let _ = rustc_serialize::json::Json::from_str(&\"[0,[\".repeat(10000));\n}\n```\n\n[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.\n","published":"2022-06-17T00:18:24Z","modified":"2023-11-08T04:13:48.926151Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"rustc-serialize","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/rust-lang-deprecated/rustc-serialize"},{"type":"PACKAGE","url":"https://github.com/rust-lang/rustc-serialize"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0004.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:13:48.926151Z"}}