CVE-2022-31099

Katalog CVE

CVSS 6.5 · Medium EPSS 0,95%

Kerentanan Uncontrolled Recursion pada pomsky-lang pomsky. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.

Rincian

Terbit di NVD

27 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-674: Uncontrolled Recursion

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363 patch · advisory pihak ketiga
• https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp advisory pihak ketiga