CVE-2022-31099: Uncontrolled Recursion in rulex

June 22, 2022 (updated July 12, 2022)

When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

This is a security concern for you, if

your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
your service becomes unavailable when the process running rulex aborts due to a stack overflow.

References

github.com/advisories/GHSA-v78m-2q7v-fjqp
github.com/rulex-rs/rulex
github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363
github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp
nvd.nist.gov/vuln/detail/CVE-2022-31099
rustsec.org/advisories/RUSTSEC-2022-0030.html

Code Behaviors & Features

Detect and mitigate CVE-2022-31099 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →