CVE-2022-31099

    Dashboard / Vulnerabilities / CVE-2022-31099

    CVE-2022-31099

    Published: 27 Jun 2022Last Modified: 27 Aug 2026

    Summary: Uncontrolled Recursion in rulex

    Details: rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31099.json, https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp, https://nvd.nist.gov/vuln/detail/CVE-2022-31099, https://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -7061f4bae01256c90c27bda03ea49eaa26796efc

    Affected versions

    v0.4.2
    v0.4.1
    v0.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31099 | CVE-DB