{"id":"GHSA-jgvr-6x5w-hx5w","title":"Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service","summary":"Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service","severity":"medium","cwe":["CWE-770"],"vendor":"zoo-kcl","product":"zoo-kcl","ecosystem":"pip","affected":["zoo-kcl < 0.3.129","kcl-lib < 0.2.129"],"patched":["zoo-kcl 0.3.129","kcl-lib 0.3.129"],"published":"2026-08-20","updated":"2026-08-20","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jgvr-6x5w-hx5w","references":[{"url":"https://github.com/KittyCAD/modeling-app/security/advisories/GHSA-jgvr-6x5w-hx5w"},{"url":"https://github.com/advisories/GHSA-jgvr-6x5w-hx5w"}],"tags":["ghsa","pip"],"ingestedAt":"2026-08-20T18:59:55.366Z","slug":"GHSA-jgvr-6x5w-hx5w","body":"## Overview\n\n### Impact\nFeeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive `expression` -> `unnecessarily_bracketed` -> `expression` path. With enough nesting, the call stack grows until it exceeds the process stack limit, causing a stack overflow.\n\n## Affected packages\n\n- `zoo-kcl < 0.3.129`\n- `kcl-lib < 0.2.129`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zoo-kcl 0.3.129`\n- `kcl-lib 0.3.129`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}