{"id":"GHSA-2226-4v3c-cff8","summary":"Stack overflow in rustc_serialize when parsing deeply nested JSON","details":"When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.\n\nExample code that triggers the vulnerability is\n\n```rust\nfn main() {\n    let _ = rustc_serialize::json::Json::from_str(&\"[0,[\".repeat(10000));\n}\n```\n\n[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.\n","aliases":["RUSTSEC-2022-0004"],"modified":"2023-11-08T04:13:48.926151Z","published":"2022-06-17T00:18:24Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-06-17T00:18:24Z"},"references":[{"type":"WEB","url":"https://github.com/rust-lang-deprecated/rustc-serialize"},{"type":"PACKAGE","url":"https://github.com/rust-lang/rustc-serialize"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2022-0004.html"}],"affected":[{"package":{"name":"rustc-serialize","ecosystem":"crates.io","purl":"pkg:cargo/rustc-serialize"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.3.24"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-2226-4v3c-cff8/GHSA-2226-4v3c-cff8.json"}}],"schema_version":"1.9.0"}