{"id":"GHSA-2226-4v3c-cff8","aliases":["RUSTSEC-2022-0004"],"status":"published","title":"Stack overflow in rustc_serialize when parsing deeply nested JSON","description":"When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.\n\nExample code that triggers the vulnerability is\n\n```rust\nfn main() {\n    let _ = rustc_serialize::json::Json::from_str(\u0026\"[0,[\".repeat(10000));\n}\n```\n\n[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-01-01T12:00:00Z","modified":"2023-11-08T04:13:48Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rustc-serialize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.24"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustc-serialize","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.3.24"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rustc-serialize","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"references":[{"url":"https://github.com/rust-lang-deprecated/rustc-serialize","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0004.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2226-4v3c-cff8"},{"url":"https://github.com/rust-lang/rustc-serialize","tags":["package"]},{"url":"https://crates.io/crates/rustc-serialize","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2226-4v3c-cff8","title":"Stack overflow in rustc_serialize when parsing deeply nested JSON","description":"When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.\n\nExample code that triggers the vulnerability is\n\n```rust\nfn main() {\n    let _ = rustc_serialize::json::Json::from_str(\u0026\"[0,[\".repeat(10000));\n}\n```\n\n[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.\n","status":"published","published":"2022-06-17T00:18:24Z","modified":"2023-01-12T05:01:02Z","updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-2226-4v3c-cff8","title":"Stack overflow in rustc_serialize when parsing deeply nested JSON","description":"When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.\n\nExample code that triggers the vulnerability is\n\n```rust\nfn main() {\n    let _ = rustc_serialize::json::Json::from_str(\u0026\"[0,[\".repeat(10000));\n}\n```\n\n[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.\n","status":"published","published":"2022-06-17T00:18:24Z","modified":"2023-11-08T04:13:48.926151Z","updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"RUSTSEC-2022-0004","title":"Stack overflow in rustc_serialize when parsing deeply nested JSON","description":"When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.\n\nExample code that triggers the vulnerability is\n\n```rust\nfn main() {\n    let _ = rustc_serialize::json::Json::from_str(\u0026\"[0,[\".repeat(10000));\n}\n```\n\n[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.","status":"published","published":"2022-01-01T12:00:00Z","modified":"2023-11-08T04:13:48.926151Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}