AIKIDO-2026-10691
scim_proto is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
scim_protoTL;DR
The SCIM filter parser builds nested logical expressions through a recursive PEG grammar without bounding recursion depth, so an attacker can submit extremely nested filter strings that exhaust stack space while parsing and take down worker threads handling unauthenticated SCIM requests. The maintenance release threads an explicit maximum depth through parse_depth/parse_complex_depth, rejects over-deep input deterministically, and adds regression tests around the recursion ceiling.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
scim_proto is vulnerable to Denial of Service (DoS) in versions 1.3.0 - 1.9.1.
How to fix this
Upgrade the scim_proto library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant