Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

serde_with

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1crates.ioPublished

    serde_with: KeyValueMap serialization panics on empty sequence or map entries

    GHSA-7gcf-g7xr-8hxj

    Affected
    • crates.io serde_with >= 2.3.0, < 3.21.0
    Fixed in
    3.21.0· Vendor fix available
    Issue
    The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serdeas(as = "KeyValueMap<")] can be crashed by an empty inner sequence or map entry. Details The affected public surface includes: - Serialization of #[serdeas(as = "KeyValueMap<")] values through serdejson::tostring or any other Serde serializer - Public KeyValueMap conversions for sequence and map-backed entries The root cause is: The KeyValueMap serializer preallocating Vec::withcapacity(len - 1) or Vec::withcapacity(len.unwrapor(17) - 1) before checking that the element actually contains the required first key field or item. The vulnerable data/control flow is: attacker-controlled empty entry - serdejson::tostring - KeyValueMap<TAs::serializeas - SeqAsMapSerializer::{serializeseq,serializemap} -…

    Recommended action: Upgrade to 3.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →