The vulnerability arises from an unbounded recursive-descent PEG parser used to parse SCIM filter query strings in the kanidmd service. The parser recurses on nested parentheses and 'not (' constructs without any depth limit, causing stack overflow when processing deeply nested filters (~4–12 KB in size). This triggers Rust's std::process::abort(), terminating the entire kanidmd process before any handler or ACL checks execute. The SCIM endpoints are unauthenticated and accessible by default, making the attack trivially repeatable. The existing depth limit is enforced only after parsing, so it does not prevent the stack overflow. The vulnerability affects scim_proto versions before 1.9.3.

An unauthenticated attacker can cause a complete denial of service by crashing the kanidmd process via a crafted SCIM filter query. This results in loss of availability for all in-flight requests, sessions, and services handled by the process. There is no impact on confidentiality or integrity. The attack is repeatable and can keep the service down indefinitely. The vulnerability does not require authentication or special configuration and is exploitable through standard HTTP GET requests to SCIM endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider implementing external protections such as limiting request URI length or filtering requests with suspiciously deep nested parentheses at the reverse proxy or firewall level. Note that typical reverse proxy limits (e.g., nginx large_client_header_buffers) may not fully mitigate the attack. Monitoring and rate limiting unauthenticated requests to SCIM endpoints may reduce attack impact.