GitHub Advisoryadvisory · crates.io

GHSA-hhw4-xg65-fp2x serde_yml crate is unsound and unmaintained

MEDIUM Published 2025-09-15 Modified 2025-09-15 Official page ↗
Ecosystem
crates.io
Packages
serde_yml
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-787
Reviewed
2025-09-15

Affected packages

• crates.io serde_yml: <= 0.0.12 (no fix yet)

Description

Using `serde_yml::ser::Serializer.emitter` can cause a segmentation fault, which is unsound. The GitHub project for `serde_yml` was archived after unsoundness issues were raised. If you rely on this crate, it is highly recommended switching to a maintained alternative. Recommended alternatives • `serde_norway` - Maintained fork of `serde_yaml`, using `unsafe-libyaml-norway` • `serde_yaml_ng` - Maintained fork of `serde_yaml`, using unmaintained `unsafe-libyaml` Incomplete pure Rust alternatives These implementation do not rely on C `libyaml`. • `serde_yaml2` • `yaml-peg`

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References