GHSA-rr69-rxr6-8qwf

serde-json-wasm stack overflow during recursive JSON parsing

Source: GitHub Advisory Database (reviewed) High CVE-2024-58264

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	serde-json-wasm	>= 1.0.0, < 1.0.1	1.0.1
crates.io	serde-json-wasm	< 0.5.2	0.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-58264 advisory
https://github.com/CosmWasm/serde-json-wasm/commit/a9a9b9bf243862bd2afbf6853fca97f30dc4f620 web
https://github.com/CosmWasm/serde-json-wasm/commit/e78f9e28b3a2151d3175ee88ab2a001bf9515429 web
https://github.com/CosmWasm/serde-json-wasm package
https://rustsec.org/advisories/RUSTSEC-2024-0012.html web