{"answers":{"affected":"2 open source packages ship an affected version, including serde_with.","exploited":"There is no known exploitation of GHSA-7gcf-g7xr-8hxj in the wild and no public exploit code.","fix":"Upgrade serde_with to 3.21.0 or later.","what":"GHSA-7gcf-g7xr-8hxj is a denial of service vulnerability in serde_with, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-7gcf-g7xr-8hxj and fix it if it is affected.\n\nWhat it is: GHSA-7gcf-g7xr-8hxj is a denial of service vulnerability in serde_with, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-7gcf-g7xr-8hxj in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- serde_with (crates.io): affected from 2.3.0; fixed in 3.21.0\n- serde_with (crates.io): affected from 2.3.0; fixed in 3.21.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7gcf-g7xr-8hxj/ (Markdown: https://insights.sbomify.com/GHSA-7gcf-g7xr-8hxj/index.md)","id":"GHSA-7gcf-g7xr-8hxj","markdown":"https://insights.sbomify.com/GHSA-7gcf-g7xr-8hxj/index.md","name":"GHSA-7gcf-g7xr-8hxj","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust serialization library","requires_auth":"none","summary":"An attacker can crash applications using serde_with KeyValueMap serialization by providing empty sequence or map entries, causing a panic.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nThe public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = \"KeyValueMap\u003c_\u003e\")]` can be crashed by an empty inner sequence or map entry.\n\n### Details\n\nThe affected public surface includes:\n\n- Serialization of `#[serde_as(as = \"KeyValueMap\u003c_\u003e\")]` values through `serde_json::to_string` or any other Serde serializer`\n- Public `KeyValueMap` conversions for sequence and map-backed entries`\n\nThe root cause is: The `KeyValueMap` serializer preallocating `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` before checking that the element actually contains the required first key field or item.\n\nThe vulnerable data/control flow is: attacker-controlled empty entry -\u003e `serde_json::to_string` -\u003e `KeyValueMap\u003cTAs\u003e::serialize_as` -\u003e `SeqAsMapSerializer::{serialize_seq,serialize_map}` -\u003e `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` -\u003e panic\n\nRelevant source locations:\n\n- `serde_with/src/key_value_map.rs:590`\n- `serde_with/src/key_value_map.rs:599`\n- `serde_with/src/key_value_map.rs:613`\n- `serde_with/src/key_value_map.rs:632`\n- `serde_with/src/key_value_map.rs:648`\n\n### PoC\n\n```rust\n/*\n[dependencies]\nserde = {version = \"*\", features = [\"derive\"]}\nserde_with = \"*\"\nserde_json = \"*\"\n*/\n\nuse serde::Serialize;\nuse serde_with::{serde_as, KeyValueMap};\n\n#[derive(Serialize)]\n#[serde(transparent)]\nstruct Seq(Vec\u003cString\u003e);\n\n#[serde_as]\n#[derive(Serialize)]\n#[serde(transparent)]\nstruct KVMap {\n    #[serde_as(as = \"KeyValueMap\u003c_\u003e\")]\n    foo: Vec\u003cSeq\u003e,\n}\n\nfn main() {\n    let value = KVMap {\n        foo: vec![Seq(Vec::new())],\n    };\n    let _ = serde_json::to_string(\u0026value).unwrap();\n}\n```\n\n### Impact\n\nA local attacker who can trigger serialization of attacker-controlled data through `KeyValueMap` can terminate the process, causing a denial of service.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"serde_with: KeyValueMap serialization panics on empty sequence or map entries","id":"GHSA-7gcf-g7xr-8hxj","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["3.21.0"],"introduced":["2.3.0"],"last_affected":[],"package":"serde_with","purl":null,"source":"GHSA-7gcf-g7xr-8hxj"},{"ecosystem":"crates.io","fixed":["3.21.0"],"introduced":["2.3.0"],"last_affected":[],"package":"serde_with","purl":"pkg:cargo/serde_with","source":"GHSA-7gcf-g7xr-8hxj"}],"products":null,"published":"2026-07-15","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker can crash applications using serde_with KeyValueMap serialization by providing empty sequence or map entries, causing a panic.","url":"https://insights.sbomify.com/GHSA-7gcf-g7xr-8hxj/"}