CVE-2023-28118

Published: Mar 20, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.

Affected (1)

Products: Kaml Project: Kaml

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kaml Project Kaml	Before 0.53.0

Related CWEs

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (6)

https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a

Source: security-advisories@github.com

Patch

https://github.com/charleskorn/kaml/releases/tag/0.53.0

Source: security-advisories@github.com

Release Notes

https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48

Source: security-advisories@github.com

Vendor Advisory

https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/charleskorn/kaml/releases/tag/0.53.0

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.