GitHub Advisoryadvisory · Maven

GHSA-c24f-2j3g-rg48 kaml has potential denial of service while parsing input with anchors and aliases

HIGH Published 2023-03-20 Modified 2023-03-20 Official page ↗
Aliases
CVE-2023-28118
Ecosystem
Maven
Packages
com.charleskorn.kaml:kaml
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-776
Reviewed
2023-03-20

Affected packages

• Maven com.charleskorn.kaml:kaml: < 0.53.0 → fixed in 0.53.0

Description

Impact Applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Patches Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. Workarounds None. References Wikipedia has an explanation of this class of vulnerability: billion laughs attack Acknowledgements Thank you to @gdude2002 for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2023-28118 kaml provides YAML support for kotlinx.serialization. vulnerability

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References