GHSA-2226-4v3c-cff8
Stack overflow in rustc_serialize when parsing deeply nested JSON
When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
What each source reports
GitHub AdvisoriesNo score
Stack overflow in rustc_serialize when parsing deeply nested JSON
When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
- Record
GHSA-2226-4v3c-cff8- Updated
- 2026-11-02
OSVNo score
Stack overflow in rustc_serialize when parsing deeply nested JSON
When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
- Record
GHSA-2226-4v3c-cff8- Updated
- 2026-11-02
OSVRUSTSEC-2022-0004No score
Stack overflow in rustc_serialize when parsing deeply nested JSON
When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
- Record
RUSTSEC-2022-0004- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rustc-serializecrates.io | through 0.3.24 | None known |
rustc-serializecrates.io | 0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2226-4v3c-cff8 is a vulnerability with no CVSS score yet in rustc-serialize, published January 1, 2022. No source lists public exploit code. No source names a fixed version.