GHSA-jgvr-6x5w-hx5w Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
Attackers can cause a denial of service by submitting deeply nested parentheses in KCL programs, crashing the parser via stack overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-jgvr-6x5w-hx5w?
GHSA-jgvr-6x5w-hx5w is a denial of service vulnerability in zoo-kcl, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive expression -> unnecessarily_bracketed -> expression path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.
Which versions are affected by GHSA-jgvr-6x5w-hx5w?
4 open source packages ship an affected version, including zoo-kcl and kcl-lib.
| Package | Affected | Fixed in |
|---|---|---|
zoo-kcl PyPI | All versions | 0.3.129 |
zoo-kcl PyPI | All versions | 0.3.129 |
kcl-lib crates.io | All versions | 0.3.129 |
kcl-lib crates.io | All versions | 0.3.129 |
How do I fix GHSA-jgvr-6x5w-hx5w?
Upgrade zoo-kcl to 0.3.129 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-jgvr-6x5w-hx5w being exploited?
There is no known exploitation of GHSA-jgvr-6x5w-hx5w in the wild and no public exploit code.