GHSA-39vw-qp34-rmwf
Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
What each source reports
GitHub AdvisoriesNo score
Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
- Record
GHSA-39vw-qp34-rmwf- Weakness
- CWE-674
- Updated
- 2026-11-02
OSVNo score
Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
- Record
GHSA-39vw-qp34-rmwf- Weakness
- CWE-674
- Updated
- 2026-11-02
OSVRUSTSEC-2018-0005No score
Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases.
This allows an attacker to make a YAML file with an alias referring to itself causing an abort.
The flaw was corrected by checking the recursion depth.
- Record
RUSTSEC-2018-0005- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
serde_yamlcrates.io | 0.6.0-rc1 up to 0.8.4 | 0.8.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-39vw-qp34-rmwf is a vulnerability with no CVSS score yet in serde_yaml, published September 17, 2018. No source lists public exploit code. Fixed in serde_yaml 0.8.4.