Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query<ScimEntryGetQuery> extractor, before any handler body and therefore before any ACL check. This issue has been patched in version 1.9.3.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Kanidm |
|
No data.
No data.
References
History
Thu, 11 Jun 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Kanidm
Kanidm kanidm |
|
| Vendors & Products |
Kanidm
Kanidm kanidm |
Wed, 10 Jun 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query<ScimEntryGetQuery> extractor, before any handler body and therefore before any ACL check. This issue has been patched in version 1.9.3. | |
| Title | Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion | |
| Weaknesses | CWE-248 CWE-400 CWE-674 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-06-10T20:28:44.009Z
Updated: 2026-06-10T20:28:44.009Z
Reserved: 2026-05-15T21:46:51.548Z
Link: CVE-2026-46689
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-06-10T22:17:00.443
Modified: 2026-06-10T22:17:00.443
Link: CVE-2026-46689
Redhat
No data.