pest_grammars
The Elegant Parser
View on Github
Activity
- Latest release
- 4d ago
- Total releases
- 75
- Cadence
- ~25 days
- Last 12 months
- 11
Reach
- Downloads
- 153.7k
- Stars
- 5.4k
Details
- License
- MIT OR Apache-2.0
- First release
- Aug 15, 2017
| Version | Released | |
|---|---|---|
2.9.5
patch
| ||
2.9.4
patch
| ||
2.9.3
patch
| ||
2.9.2
patch
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.9.1
patch
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.9.0
minor
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.8
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.7
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.6
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.5
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.4
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.3
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.2
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.1
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.8.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.15
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.14
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.13
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.12
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.11
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.10
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.9
unknown
yanked
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.8
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.7
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.6
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.5
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.4
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.3
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.2
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.1
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.7.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.6.1
unknown
yanked
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.6.0
unknown
yanked
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.7
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.6
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.5
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.4
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.3
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.2
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.1
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.5.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.4.1
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.4.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.3.1
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.3.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.2.1
unknown
yanked
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.2.0
unknown
yanked
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.1.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
2.0.0
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev | ||
1.0.6
unknown
1 CVE
RUSTSEC-2026-0366
GHSA-7632-4q2x-hvjw
Oct 16, 2026
Stack overflow when parsing deeply nested input in pest_grammars
3.3
/ 10
Low
Local
Low
Low
None
Unchanged
None
None
Low
ImpactIn affected versions, parsing deeply nested input with The reported reproduction demonstrates this behavior with deeply nested JSON arrays. The nesting required to trigger an overflow depends on the platform, available stack space, and build configuration; there is no portable safe nesting threshold. PatchesUpgrade to Version 2.9.3 requires the updated These checks are best-effort. They do not provide universal stack-overflow protection, apply when stack bounds cannot be determined, or provide native-stack protection in no_std builds. Workarounds and defense in depthApplications unable to upgrade should reject excessive nesting before invoking the affected parser or configure a suitably conservative Even after upgrading, applications parsing untrusted input should enforce workload-appropriate input, work, memory, and concurrency limits. Stack checks and call budgets do not enforce elapsed-time deadlines. Where a hard deadline or cancellation is required, use supervised parsing as described in the security policy: Parsing Untrusted Input. Fixed in
2.9.3
References Updated Oct 16, 2026 · Source: OSV.dev |