3.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-j87p-gjr6-m4pv

GHSA-j87p-gjr6-m4pv: Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rr69-rxr6-8qwf. This link is maintained to preserve external references.

Original Description

The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-j87p-gjr6-m4pv

GHSA-j87p-gjr6-m4pv:

3.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
serde-json-wasm	rust	= 1.0.0	1.0.1
serde-json-wasm	rust	< 0.5.2	0.5.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the recursive nature of the JSON deserializer in serde-json-wasm. When parsing deeply nested JSON objects or arrays, the deserializer functions would call themselves or other deserializer functions without any limit on the recursion depth. This leads to a stack overflow, causing a denial of service.

The patch addresses this by introducing a recursion limit. A remaining_depth counter is added to the Deserializer struct, initialized to a safe limit (128). A macro, check_recursion!, is then used to wrap the recursive calls within the deserialization logic. This macro decrements the counter before a recursive call and increments it after, returning a RecursionLimitExceeded error if the counter reaches zero.

The vulnerable functions are the methods of the Deserializer that handle the deserialization of recursive structures (arrays and maps), namely deserialize_any, deserialize_seq, deserialize_map, and deserialize_enum. The patch files clearly show the addition of the check_recursion! macro in these functions, which is direct evidence of where the vulnerability was addressed. Any of these functions could appear in a stack trace during the exploitation of this vulnerability when a malicious, deeply nested JSON is provided as input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.2

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-j87p-gjr6-m4pv: Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Duplicate Advisory

Original Description

GHSA-j87p-gjr6-m4pv:

3.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

3.2

3.2

GHSA-j87p-gjr6-m4pv: Duplicate Advisory: serde-json-wasm stack overflow during recursive JSON parsing

Duplicate Advisory

Original Description

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI