Fixing a stack-overflow DoS in OSV-Scanner's SPDX license parser

[Amey-Thakur]

OSV-Scanner  ·  SPDX Parser  ·  Stack-Overflow Fix

This fork exists for one contribution to Google's OSV-Scanner: finding and fixing a denial-of-service in its SPDX license parser. Merged into main on 2 September 2026, and the issue closed as completed the same minute.

The full write-up is here: A Stack-Overflow Denial of Service in Google's OSV-Scanner, covering the mechanism, the merged code, the regression test, and what contributing upstream to Google involved.

 

The bug

spdx.Satisfies parses SPDX license expressions with an unbounded recursive descent. License strings are untrusted input, taken from the metadata of whatever packages are being scanned. A license string of deeply nested brackets recurses until the goroutine stack overflows, and a Go stack overflow is a fatal error that recover cannot catch, so the entire scan process aborts. Roughly a 3 MB string of ( characters is enough.

CWE-674, Uncontrolled Recursion.

 

The fix

A nesting-depth counter threaded through the recursive descent. Past a generous ceiling of 1,000 levels, the parser returns an ordinary parse error instead of recursing further. Real SPDX expressions nest only a few levels, so nothing legitimate is rejected; an over-nested expression now fails like any other invalid input rather than killing the process.

 

The trail

Step	Link
Issue filed, with reproduction	google/osv-scanner#2993
Assigned by the maintainers	assignment and go-ahead
Fix merged	google/osv-scanner#3032, 40 lines added across 2 files
Merge commit on main	1c93dc4
Issue closed as completed	google/osv-scanner#2993
The change itself	fix/spdx-recursion-depth-limit
Write-up, with references	Amey's Arc

 

Verification

• A regression test drives a 2,000,000-deep expression and asserts a parse error. Without the fix it crashes fatally; with it, it passes in under half a second.
• Boundary-checked: legitimate shallow nesting parses, nesting at the ceiling parses, one level past fails cleanly, and sequential non-nested brackets do not accumulate depth.
• go test ./internal/spdx/ passes; gofmt and go vet are clean.

 

 

The whole thing, in one animation

Four beats, and it is built to be understood without reading any Go. The
nesting is drawn as rectangles closing inward, which is what deepening
recursion looks like, and the number on screen is the depth the parser was
actually tracking as it descended.

Beat	What it shows
1	What OSV-Scanner is, and that one crafted string brought a scan down
2	It reads a licence string from every package, and nothing limited how deep that string could nest. The counter runs to three million and the frame turns red
3	The ceiling at 1,000. The same climb, stopped cleanly, in green
4	Merged, with the issue, the pull request and the dates

 

The three renderings

All 1080 x 1080, generated from one frame list so they cannot disagree with
each other.

File	Length	What it is for
spdx-recursion-fix.mp4	26.6s	The full explainer, H.264 at 117 kb/s. The one to use where video is measured
spdx-recursion-fix.gif	26.6s	The same, as a GIF, for places that will not take a video
spdx-recursion-fix-loop.gif	6.5s	The crash and the fix only, trimmed to loop

The short loop, for a feed that scrolls faster:

They live on the media
branch of this fork, which is an orphan branch sharing no history with main or
with the branch that was merged. Neither of those should carry media that was
never part of the change.

 

Where it stands

The fix is on main. It is not in a tagged release yet: the newest release at the time of writing is v2.5.1 from 17 August 2026, which predates the merge. Anyone who needs the fix today builds from main; everyone else gets it in the next release.

 

The scanner and its code belong to Google and the OSV-Scanner contributors. This fork carries the branch that was merged, signed and submitted upstream under the Google CLA.

---

More open-source work is indexed at github.com/Amey-Thakur