Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

kanidm_proto

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7crates.ioPublished

    scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion

    CVE-2026-46689 · GHSA-r5fr-9gmv-jggh

    Affected
    • crates.io kanidm_proto <= 1.9.2
    Fixed in
    1.9.3· Vendor fix available
    Issue
    A single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query<ScimEntryGetQuery extractor, before any handler body and therefore before any ACL check. Details The SCIM filter grammar recurses on ( and not ( with no depth bound. proto/src/scimv1/mod.rs:263-433 — peg::parser! { grammar scimfilter() ... }: Both rules re-enter parse() without a depth counter. proto/src/scimv1/mod.rs:442-447 — impl FromStr for ScimFilter calls scimfilter::parse(input) directly on the raw string with no length or depth pre-check. proto/src/scimv1/mod.rs:80-81 — ScimEntryGetQuery.filter is #[serdeas(as = "Option<DisplayFromStr")], so deserialising the query struct invokes ScimFilter::fromstr on attacker bytes.…

    Recommended action: Upgrade to 1.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →