GHSA-HHW4-XG65-FP2X

Vulnerability from github – Published: 2025-09-15 13:58 – Updated: 2025-09-15 13:58
VLAI?
Summary
serde_yml crate is unsound and unmaintained
Details

Using serde_yml::ser::Serializer.emitter can cause a segmentation fault, which is unsound.

The GitHub project for serde_yml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

  • serde_norway - Maintained fork of serde_yaml, using unsafe-libyaml-norway
  • serde_yaml_ng - Maintained fork of serde_yaml, using unmaintained unsafe-libyaml

Incomplete pure Rust alternatives

These implementation do not rely on C libyaml.

Severity ?
6.9 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "serde_yml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T13:58:35Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Using `serde_yml::ser::Serializer.emitter` can cause a segmentation fault, which is unsound.\n\nThe GitHub project for `serde_yml` was archived after unsoundness issues were raised.\n\nIf you rely on this crate, it is highly recommended switching to a maintained alternative.\n\n## Recommended alternatives\n\n- [`serde_norway`](https://crates.io/crates/serde_norway) - Maintained fork of `serde_yaml`, using `unsafe-libyaml-norway`\n- [`serde_yaml_ng`](https://crates.io/crates/serde_yaml_ng) - Maintained fork of `serde_yaml`, using unmaintained `unsafe-libyaml`\n\n## Incomplete pure Rust alternatives\n\nThese implementation do not rely on C `libyaml`.\n\n- [`serde_yaml2`](https://crates.io/crates/serde_yaml2)\n- [`yaml-peg`](https://crates.io/crates/yaml-peg)",
  "id": "GHSA-hhw4-xg65-fp2x",
  "modified": "2025-09-15T13:58:35Z",
  "published": "2025-09-15T13:58:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rustsec/advisory-db/issues/2395"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sebastienrousseau/serde_yml"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0068.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "serde_yml crate is unsound and unmaintained"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.