---
id: CVE-2022-31099
aliases:
  - RUSTSEC-2022-0030
  - GHSA-v78m-2q7v-fjqp
title: Stack overflow during recursive expression parsing
summary: Stack overflow during recursive expression parsing
severity: none
vendor: rulex
product: rulex
ecosystem: rust
affected:
  - 'rulex >= 0.0.0-0, < 0.4.3'
patched:
  - rulex 0.4.3
published: '2022-05-21'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:05.119333870Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0030'
references:
  - url: 'https://crates.io/crates/rulex'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0030.html'
  - url: >-
      https://github.com/rulex-rs/rulex/commit/60aa2dc03a22d69c8800fec81f99c96958a11363
tags:
  - osv
  - rust
epss: 0.00969
epssPercentile: 0.61694
ingestedAt: '2026-10-13T11:45:30.155Z'
---

## Overview

When parsing untrusted rulex expressions, the stack may overflow, possibly
enabling a Denial of Service attack. This happens when parsing an expression
with several hundred levels of nesting, causing the process to abort
immediately.

The flaw was corrected in commits `60aa2dc03a` by adding a check to recursion
depth.

## Affected packages

- `rulex >= 0.0.0-0, < 0.4.3`

## Remediation

Upgrade to a patched release:

- `rulex 0.4.3`