AIKIDO-2026-764298

TL;DR

The parser tracks expression nesting depth with a listener that increments a counter when entering an expression and decrements it when exiting. During error recovery on malformed input the parser can emit an exit callback without a matching enter, so the unchecked counter underflows, and deeply nested expressions can overflow it. This integer overflow or underflow triggers a panic that terminates the process, causing denial of service when untrusted expressions are parsed. The fix switches the depth counter to saturating arithmetic so malformed or deeply nested input returns a parse error instead of panicking.