Skip to content
Fencer Intel
medium —

GHSA-jgvr-6x5w-hx5w json

Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service

published 2mo ago modified 2mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive `expression` -> `unnecessarily_bracketed` -> `expression` path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.

Patch / fix

  • pypi zoo-kcl 0.3.129
  • crates.io kcl-lib 0.3.129

Is GHSA-jgvr-6x5w-hx5w in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
pypi zoo-kcl
<0.3.129
0.3.129
crates.io kcl-lib
<0.3.129
0.3.129

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.