CVE-2026-46689

Name of the Vulnerable Software and Affected Versions Kanidm versions prior to 1.9.3

Description An unauthenticated GET request to any /scim/v1/... endpoint using a ?filter= query string containing several thousand nested parentheses (approximately 4–12 KB) can cause a stack overflow. This occurs because the recursive-descent PEG parser lacks a depth bound when processing the SCIM filter grammar. The parsing process happens within the Query<ScimEntryGetQuery> extractor before any handler body or Access Control List (ACL) check is performed. Consequently, the Rust runtime triggers std::process::abort(), causing the entire kanidmd process to exit and resulting in a complete loss of service availability. Affected endpoints include /scim/v1/Entry, /scim/v1/Entry/{id}, /scim/v1/Person/{id}, /scim/v1/Application, /scim/v1/Application/{id}, /scim/v1/Class, /scim/v1/Attribute, /scim/v1/Message, and /scim/v1/Message/{id}.

Recommendations Update to version 1.9.3.