CVE-2018-21232: 
NixOS vulnerability analysis and mitigation

re2c before version 2.0 contains a vulnerability involving uncontrolled recursion that causes stack consumption in the find_fixed_tags function. The issue was initially discovered by Sergei Trofimovich and reported by Agostino Sarubbo to the upstream maintainers in 2018 (OSS Security).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion) and has received a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The issue manifests as a stack overflow condition when processing certain inputs, particularly noticeable on systems with limited stack size (NVD).

The vulnerability primarily affects the availability of the system, potentially leading to crashes through stack consumption. The CVSS scoring indicates high impact on availability (A:H) while having no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and user interaction (UI:R). No privileged access is required (PR:N) to exploit the issue (NVD).

The vulnerability was fixed in re2c version 2.0 through multiple commits that rewrote recursive functions into iterative implementations. The fixes included changes to Tarjan's SCC algorithm, YYFILL states, undefined control flow paths, skeleton max path length computation, and insertion of negative tags in RE (OSS Security).