An unauthenticated attacker can cause the kanidmd process to abort by sending a specially crafted GET request to any /scim/v1/... endpoint with a deeply nested SCIM filter query string. The recursive parser for SCIM filters does not limit recursion depth, leading to a stack overflow and process abort before any authorization checks occur. This results in a denial of service by crashing the entire process. The vulnerability affects versions prior to 1.9.3 and requires no authentication or special feature flags.