What is CVE-2021-39194?

CVE-2021-39194 is a medium-severity vulnerability in Charleskorn Kaml, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 4.3/10. Published 2021-09-07.

How severe is CVE-2021-39194?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Charleskorn Kaml

CVE-2021-39194

kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue.

EPSS: 0.017 (74.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

Affected products

Charleskorn Kaml — versions < 0.35.2
Kaml_project Kaml

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
security-advisories@github.com (Exploit, Patch, Third Party Advisory, x_refsource_MISC)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-39194?: CVE-2021-39194 is a medium-severity vulnerability in Charleskorn Kaml, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 4.3/10. Published 2021-09-07.
How severe is CVE-2021-39194?: Medium severity. CVSS v3 base score is 4.3 out of 10.