CVE-2023-28118 kaml has potential denial of service while parsing input with anchors and aliases
Attackers can cause excessive memory consumption and crashes in applications using kaml to parse untrusted YAML input with anchors and aliases.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-28118?
CVE-2023-28118 is a high-severity denial of service vulnerability in charleskorn kaml, published on 20 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.
Weakness: CWE-776
Which versions are affected by CVE-2023-28118?
2 open source packages ship an affected version, including com.charleskorn.kaml:kaml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.charleskorn.kaml:kaml Maven | All versions | 0.53.0 |
com.charleskorn.kaml:kaml Maven | All versions | 0.53.0 |
Products include Kaml Project Kaml.
How do I fix CVE-2023-28118?
Upgrade com.charleskorn.kaml:kaml to 0.53.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-28118 being exploited?
There is no known exploitation of CVE-2023-28118 in the wild and no public exploit code.
Other vulnerabilities in charleskorn kaml
Sources
Also known as GHSA-c24f-2j3g-rg48.