{"id":"EUVD-2022-6161","enisaUuid":"11573bad-e850-3e74-9858-47190bf7c1b7","description":"rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.","datePublished":"Jun 27, 2022, 10:10:20 PM","dateUpdated":"Apr 23, 2025, 6:06:21 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp\nhttps://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363\n","aliases":"CVE-2022-31099\nGHSA-v78m-2q7v-fjqp\n","assigner":"GitHub_M","epss":0.97,"enisaIdProduct":[{"id":"02a4ed5e-1ae6-37e2-a0a8-9fd0c924de9f","product":{"name":"rulex","vendor":{"name":"rulex-rs"}},"product_version":"\u003c 0.4.3"}],"enisaIdVendor":[{"id":"13e447c9-6d9a-37a2-9185-fc1a4748731e","vendor":{"name":"rulex-rs"}}],"enisaIdVulnerability":[{"id":"07e5cb9f-1ce6-32e1-a359-56416cbd1b65","vulnerability":{"id":"CVE-2022-31099","description":"rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately. This is a security concern for you, if your service parses untrusted rulex expressions (expressions provided by an untrusted user), and your service becomes unavailable when the process running rulex aborts due to a stack overflow. The crash is fixed in version **0.4.3**. Affected users are advised to update to this version. There are no known workarounds for this issue.","datePublished":"Jun 27, 2022, 10:10:20 PM","dateUpdated":"Apr 23, 2025, 6:06:21 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp\nhttps://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363\n","enisa_id":"EUVD-2022-6161\n","assigner":"GitHub_M","epss":0.97,"dataProcessed":"Oct 28, 2026, 7:19:59 AM","vulnerabilityProduct":[{"id":"9f269efc-3c03-397b-bda5-1b8fd258609f","product":{"name":"rulex","vendor":{"name":"rulex-rs"}},"product_version":"\u003c 0.4.3"},{"id":"c294c00f-87fe-4572-a064-9d2a08b3611f","product":{"name":"rulex","vendor":{"name":"rulex-rs"}},"product_version":"\u003c 0.4.3"}],"vulnerabilityVendor":[{"id":"2e2fa4c7-360e-38fe-99fd-583ce3b14165","vendor":{"name":"rulex-rs"}}]}},{"id":"596c2ed8-9ec9-36ff-8074-a5a6eabee94b","vulnerability":{"id":"GHSA-v78m-2q7v-fjqp","description":"Uncontrolled Recursion in rulex","datePublished":"Jun 22, 2022, 5:52:51 PM","dateUpdated":"Jul 12, 2022, 9:59:11 PM","baseScore":null,"references":"https://github.com/rulex-rs/rulex/security/advisories/GHSA-v78m-2q7v-fjqp\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-31099\nhttps://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363\nhttps://github.com/rulex-rs/rulex\nhttps://rustsec.org/advisories/RUSTSEC-2022-0030.html\n","enisa_id":"EUVD-2022-6161\n","aliases":"GHSA-v78m-2q7v-fjqp\nCVE-2022-31099\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:05:13 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}