CVE-2021-39194
Description
kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.charleskorn.kaml:kamlMaven | < 0.35.3 | 0.35.3 |
Affected products
3- Range: < 0.35.2
Patches
Vulnerability mechanics
References
5- github.com/charleskorn/kaml/commit/e18785d043fc6324c81e968aae9764b4b060bc6anvdPatchThird Party AdvisoryWEB
- github.com/charleskorn/kaml/issues/179nvdExploitPatchThird Party AdvisoryWEB
- github.com/charleskorn/kaml/security/advisories/GHSA-fmm9-3gv8-58f4nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-fmm9-3gv8-58f4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-39194ghsaADVISORY
News mentions
0No linked articles in our index yet.