GHSA-39vw-qp34-rmwfMediumDisclosed before NVD

Uncontrolled recursion leads to abort in deserialization

Published
August 25, 2021
Last Modified
June 13, 2023

📋 Description

Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.

🎯 Affected products1

  • rust/serde_yaml:>= 0.6.0-rc1, < 0.8.4

🔗 References (4)