Vulnerability · Published Mar 20, 2023 · Assigned by GitHub_M

CVE-2023-28118kaml has potential denial of service while parsing input with anchors and aliases

High 7.5

In plain English

A high-severity security flaw in kaml from charleskorn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 37.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.charleskorn.kaml:kaml	0.53.0	GHSA-c24f-2j3g-rg48

Affected products (as reported)

Vendor	Product	Versions
charleskorn	kaml	< 0.53.0

Weakness: CWE-776 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48 x_refsource_CONFIRM
https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a x_refsource_MISC
https://github.com/charleskorn/kaml/releases/tag/0.53.0 x_refsource_MISC