AIKIDO-2026-525182

TL;DR

The TOML parser parses nested arrays, nested inline tables, and dotted keys recursively, and every nesting level or dotted-key fragment adds a level of recursion without any depth limit. Crafted deeply nested input drives this recursion until it exhausts the interpreter stack. Before the fix, such input crashed the parsing process with an uncontrolled RecursionError, allowing a denial of service against any application that parses attacker-controlled TOML. The fix enforces a maximum nesting depth of 100 for values and dotted-key fragments and raises a ParseError instead of recursing without bound.