---
id: CVE-2022-31100
aliases:
  - RUSTSEC-2022-0031
  - GHSA-8v9w-p43c-r885
title: Panic due to improper UTF-8 indexing
summary: Panic due to improper UTF-8 indexing
severity: none
vendor: rulex
product: rulex
ecosystem: rust
affected:
  - 'rulex >= 0.0.0-0, < 0.4.3'
patched:
  - rulex 0.4.3
published: '2022-05-21'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:05.115301404Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0031'
references:
  - url: 'https://crates.io/crates/rulex'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0031.html'
  - url: >-
      https://github.com/rulex-rs/rulex/commit/fac6d58b25c6f9f8c0a6cdc4dec75b37b219f1d6
tags:
  - osv
  - rust
epss: 0.00878
epssPercentile: 0.58865
ingestedAt: '2026-10-13T11:45:30.156Z'
---

## Overview

When parsing untrusted rulex expressions, rulex may panic, possibly enabling
a Denial of Service attack. This happens when the expression contains a multi-
byte UTF-8 code point in a string literal or after a backslash, because rulex
tries to slice into the code point and panics as a result.

The flaw was corrected in commits `fac6d58b25` and `330b3534e7` by using
`len_utf8()` to derive character width in bytes instead of assuming ASCII
encoding of 1 byte per char.

## Affected packages

- `rulex >= 0.0.0-0, < 0.4.3`

## Remediation

Upgrade to a patched release:

- `rulex 0.4.3`