{"id":"GHSA-39vw-qp34-rmwf","aliases":["RUSTSEC-2018-0005"],"status":"published","title":"Uncontrolled recursion leads to abort in deserialization","description":"Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2018-09-17T12:00:00Z","modified":"2023-11-08T04:14:33Z","fixes":[{"ecosystem":"crates.io","package":"serde_yaml","fixed_in":["0.8.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"serde_yaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0-rc1"},{"fixed":"0.8.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"serde_yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0-rc1"},{"fixed":"0.8.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"serde_yaml","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0-rc1"},{"fixed":"0.8.4"}]}]}],"references":[{"url":"https://github.com/dtolnay/serde-yaml/pull/105","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2018-0005.html","tags":["web","advisory"]},{"url":"https://github.com/dtolnay/serde-yaml/commit/b93aff6e904cffbbfd1f421b82f6dcc5ca19a4fd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-39vw-qp34-rmwf"},{"url":"https://github.com/dtolnay/serde-yaml","tags":["package"]},{"url":"https://crates.io/crates/serde_yaml","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-39vw-qp34-rmwf","title":"Uncontrolled recursion leads to abort in deserialization","description":"Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.\n","status":"published","published":"2021-08-25T21:00:18Z","modified":"2023-06-13T21:03:37Z","cwes":["CWE-674"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"osv":[{"id":"GHSA-39vw-qp34-rmwf","title":"Uncontrolled recursion leads to abort in deserialization","description":"Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.\n","status":"published","published":"2021-08-25T21:00:18Z","modified":"2023-11-08T04:14:33.650192Z","cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"RUSTSEC-2018-0005","title":"Uncontrolled recursion leads to abort in deserialization","description":"Affected versions of this crate did not properly check for recursion\nwhile deserializing aliases.\n\nThis allows an attacker to make a YAML file with an alias referring\nto itself causing an abort.\n\nThe flaw was corrected by checking the recursion depth.","status":"published","published":"2018-09-17T12:00:00Z","modified":"2023-11-08T04:14:33.650192Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}