{"id":"CVE-2022-31100","aliases":["RUSTSEC-2022-0031","GHSA-8v9w-p43c-r885"],"title":"Panic due to improper UTF-8 indexing","summary":"Panic due to improper UTF-8 indexing","severity":"none","vendor":"rulex","product":"rulex","ecosystem":"rust","affected":["rulex >= 0.0.0-0, < 0.4.3"],"patched":["rulex 0.4.3"],"published":"2022-05-21","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:05.115301404Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0031","references":[{"url":"https://crates.io/crates/rulex"},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0031.html"},{"url":"https://github.com/rulex-rs/rulex/commit/fac6d58b25c6f9f8c0a6cdc4dec75b37b219f1d6"}],"tags":["osv","rust"],"epss":0.00878,"epssPercentile":0.58865,"ingestedAt":"2026-10-13T11:45:30.156Z","slug":"CVE-2022-31100","body":"## Overview\n\nWhen parsing untrusted rulex expressions, rulex may panic, possibly enabling\na Denial of Service attack. This happens when the expression contains a multi-\nbyte UTF-8 code point in a string literal or after a backslash, because rulex\ntries to slice into the code point and panics as a result.\n\nThe flaw was corrected in commits `fac6d58b25` and `330b3534e7` by using\n`len_utf8()` to derive character width in bytes instead of assuming ASCII\nencoding of 1 byte per char.\n\n## Affected packages\n\n- `rulex >= 0.0.0-0, < 0.4.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rulex 0.4.3`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}