VULNERABILITY INTELLIGENCE
CVE-2023-28118
CVSS score7.5 HIGH
EPSS probability0.97%
CISA KEVNot currently listed
Published2023-03-20
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.
Weakness classification
- security-advisories@github.com: CWE-776
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory