GHSA-2226-4v3c-cff8 Stack overflow in rustc_serialize when parsing deeply nested JSON
Attackers can cause a stack overflow and crash the application by providing deeply nested JSON input to the rustc_serialize library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-2226-4v3c-cff8?
GHSA-2226-4v3c-cff8 is a denial of service vulnerability in rustc-serialize, published on 1 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When parsing JSON using json::Json::from_str, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
Which versions are affected by GHSA-2226-4v3c-cff8?
3 open source packages ship an affected version, including rustc-serialize.
| Package | Affected | Fixed in |
|---|---|---|
rustc-serialize crates.io | All versions to 0.3.24 | None |
rustc-serialize crates.io | All versions to 0.3.24 | None |
rustc-serialize crates.io | From 0.0.0-0 | None |
How do I fix GHSA-2226-4v3c-cff8?
No fix has been published for GHSA-2226-4v3c-cff8 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-2226-4v3c-cff8 being exploited?
There is no known exploitation of GHSA-2226-4v3c-cff8 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0004.