Description
When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
```rust
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
```
[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | rustc-serialize | <= 0.3.24 | — | GHSA-2226-4v3c-cff8 |
| crates.io | rustc-serialize | >= 0.0.0-0 | — | RUSTSEC-2022-0004 |