CVE-2023-28118CWE-776

kaml has potential denial of service while parsing input with anchors and aliases

High · published March 20, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
61.7
In the wild
Unconfirmed
What it is

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00974 · 61.7th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2023-03-20T12:39Z
EPSS history
Timeline
  • 20 MAR 12:39Z
    kaml has potential denial of service while parsing input with anchors and aliases
    cvelistv5