Kanidm identity management servers suffered a stack overflow in the SCIM filter parser when an unauthenticated GET request to any /scim/v1/... endpoint contained a query string with a few thousand nested parentheses. The parser runs before any access control checks, and the resulting stack exhaustion triggers Rust’s std::process::abort(), terminating the entire kanidmd process. The vulnerability leads to an unwarranted service interruption and is not exploitable for code execution or privilege escalation. The weakness falls under CWE‑400 (Uncontrolled Resource Consumption), CWE‑248 (Excessive Resource Consumption), and CWE‑674 (Unchecked Return Value/Uncontrolled Recursion).

Any installation of Kanidm using a version earlier than 1.9.3—any variant of the kanidm product— is affected. An update to version 1.9.3 or later removes the recursive parser and eliminates the stack guard failure.

The CVSS v3 score of 8.7 classifies this issue as high severity. No EPSS score is currently reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploits yet. Attackers can trigger the denial of service simply by sending a crafted, unauthenticated HTTP GET to the vulnerable SCIM endpoint, which is reachable over the network, implying a high likelihood of exploitation in hostile environments.