GHSA-2226-4v3c-cff8: Stack overflow in rustc_serialize when parsing deeply nested JSON

June 17, 2022

When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.

Example code that triggers the vulnerability is

fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}

serde is recommended as a replacement to rustc_serialize.

References

github.com/advisories/GHSA-2226-4v3c-cff8
github.com/rust-lang-deprecated/rustc-serialize
github.com/rust-lang/rustc-serialize
rustsec.org/advisories/RUSTSEC-2022-0004.html

Code Behaviors & Features

Detect and mitigate GHSA-2226-4v3c-cff8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →