AIKIDO-2026-488295

TL;DR

kanidm parses the SCIM filter= query parameter with a PEG grammar that recurses once per parenthesis. A depth guard checks the limit only after each nested rule is entered, so it bounds the accepted tree depth but not the native recursion. Because the query is deserialized by the HTTP layer before any authentication decision, an unauthenticated request to a SCIM endpoint triggers a Rust stack overflow that aborts the whole server process. The fix rejects overly nested filters before descending into them.