Denial of Service Vulnerability in serde_with Package: KeyValueMap Serialization Panic
Summary
GHSA-7gcf-g7xr-8hxj: serde_with: KeyValueMap serialization panics on empty sequence or map entries. Affects serde_with versions < 3.21.0. Fixed in 3.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The serde_with package is a Rust library that provides utilities for serializing and deserializing data structures using Serde. One of its key features is the KeyValueMap serializer, which allows for the serialization of maps with custom key-value pairs. However, this package is vulnerable to a denial of service attack due to improper handling of empty sequences or map entries during serialization.
Vulnerability Detail
The vulnerability arises from the KeyValueMap serializer's assumption that each mapped element contains at least one field or item to serve as the map key. It incorrectly preallocates a vector with a capacity of 'len - 1' before validating this assumption. If an attacker provides an empty inner sequence or map entry, it can lead to a panic during serialization, causing the application to crash. This vulnerability can be exploited by an attacker who can control the data being serialized, resulting in a denial of service.
How To Fix
Minimum fixed version
3.21.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the data being serialized does not contain any empty sequences or map entries. For example, modify the code to check for empty entries before serialization:
let value = KVMap {
foo: vec![Seq(Vec::from(vec!["valid_key".to_string()]))],
};
Conclusion
The serde_with package has a vulnerability in its KeyValueMap serializer that can lead to denial of service through panics caused by empty sequences or map entries. It is crucial to update to the patched version and implement workarounds to ensure application stability.
See every vulnerability recorded for serde_with →
FAQ
The vulnerability is a denial of service issue caused by the KeyValueMap serializer panicking when it encounters empty sequences or map entries.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Update the serde_with package to version 3.21.0 or later in your Cargo.toml file and run 'cargo update' to apply the fix.
Yes, you can implement a workaround by ensuring that no empty sequences or map entries are passed to the KeyValueMap serializer.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of severity.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
