CVE-2022-31099

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version 0.4.3. Affected users are advised to update to this version. There are no known workarounds for this issue.

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version 0.4.3. Affected users are advised to update to this version. There are no known workarounds for this issue.

Impact

When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

This is a security concern for you, if

• your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
• your service becomes unavailable when the process running rulex aborts due to a stack overflow.

Patches

The crash is fixed in version 0.4.3. Affected users are advised to update to this version.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

• Open an issue in rulex
• Email me at [email protected]

Credits

Credit for finding these bugs goes to

• evanrichter
• ForAllSecure Mayhem
• cargo fuzz and afl.rs

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version 0.4.3. Affected users are advised to update to this version. There are no known workarounds for this issue.

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version 0.4.3. Affected users are advised to update to this version. There are no known workarounds for this issue.

Impact

When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

This is a security concern for you, if

• your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
• your service becomes unavailable when the process running rulex aborts due to a stack overflow.

Patches

The crash is fixed in version 0.4.3. Affected users are advised to update to this version.

Workarounds

None.

For more information

If you have any questions or comments about this advisory:

• Open an issue in rulex
• Email me at [email protected]

Credits

Credit for finding these bugs goes to

• evanrichter
• ForAllSecure Mayhem
• cargo fuzz and afl.rs

When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

The flaw was corrected in commits 60aa2dc03a by adding a check to recursion depth.