libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the yrre_emit function.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9304.json"