GHSA-hhw4-xg65-fp2x serde_yml crate is unsound and unmaintained

Not scored Published 11 Sep 2025

Unsoundness in serde_yml can cause segmentation faults, leading to denial of service; users should switch to maintained alternatives.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is GHSA-hhw4-xg65-fp2x?

GHSA-hhw4-xg65-fp2x is a memory corruption vulnerability in serde_yml, published on 11 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Using serde_yml::ser::Serializer.emitter can cause a segmentation fault, which is unsound.

The GitHub project for serde_yml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

serde_norway - Maintained fork of serde_yaml, using unsafe-libyaml-norway
serde_yaml_ng - Maintained fork of serde_yaml, using unmaintained unsafe-libyaml

Incomplete pure Rust alternatives

These implementation do not rely on C libyaml.

Which versions are affected by GHSA-hhw4-xg65-fp2x?

3 open source packages ship an affected version, including serde_yml.

Package	Affected	Fixed in
`serde_yml` crates.io	All versions to `0.0.12`	None
`serde_yml` crates.io	All versions to `0.0.12`	None
`serde_yml` crates.io	From `0.0.0-0`	None

How do I fix GHSA-hhw4-xg65-fp2x?

No fix has been published for GHSA-hhw4-xg65-fp2x yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is GHSA-hhw4-xg65-fp2x being exploited?

There is no known exploitation of GHSA-hhw4-xg65-fp2x in the wild and no public exploit code.

Sources

Also known as RUSTSEC-2025-0068.