{"id":"CVE-2022-31099","revision":"eb9c88d3ebd44371a9cf04a9c0afaaaf","records":[{"revision":"eb9c88d3ebd44371a9cf04a9c0afaaaf","observedAt":"2026-10-24T20:17:25.018+00:00","statement":{"source":"nvd","id":"CVE-2022-31099","aliases":[],"title":"rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of ne…","description":"rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.","state":0,"publishedAt":"2022-06-27T23:15:08.043+00:00","modifiedAt":"2026-06-17T04:44:47.717+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"},{"system":"CVSS 2.0 · nvd@nist.gov · Primary","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","score":4,"severity":"MEDIUM"}],"references":["https://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363","https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-31099","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-674"],"productCriteria":["cpe:2.3:a:pomsky-lang:pomsky:*:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2022-06-27T23:15:08.043","lastModified":"2026-06-17T04:44:47.717"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2022-31099","identifiers":["CVE-2022-31099"]},"retained":false,"historicalAffected":[]}],"coverage":[]}