PT-2026-60657 · Crates.Io · Serde With
Published
2026-07-15
·
Updated
2026-07-15
CVSS v4.0
5.1
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Summary
The public
KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde as(as = "KeyValueMap< >")] can be crashed by an empty inner sequence or map entry.Details
The affected public surface includes:
- Serialization of
#[serde as(as = "KeyValueMap< >")]values throughserde json::to stringor any other Serde serializer` - Public
KeyValueMapconversions for sequence and map-backed entries`
The root cause is: The
KeyValueMap serializer preallocating Vec::with capacity(len - 1) or Vec::with capacity(len.unwrap or(17) - 1) before checking that the element actually contains the required first key field or item.The vulnerable data/control flow is: attacker-controlled empty entry ->
serde json::to string -> KeyValueMap<TAs>::serialize as -> SeqAsMapSerializer::{serialize seq,serialize map} -> Vec::with capacity(len - 1) or Vec::with capacity(len.unwrap or(17) - 1) -> panicRelevant source locations:
serde with/src/key value map.rs:590serde with/src/key value map.rs:599serde with/src/key value map.rs:613serde with/src/key value map.rs:632serde with/src/key value map.rs:648
PoC
rust
/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde with = "*"
serde json = "*"
*/
use serde::Serialize;
use serde with::{serde as, KeyValueMap};
#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);
#[serde as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
#[serde as(as = "KeyValueMap< >")]
foo: Vec<Seq>,
}
fn main() {
let value = KVMap {
foo: vec![Seq(Vec::new())],
};
let = serde json::to string(&value).unwrap();
}Impact
A local attacker who can trigger serialization of attacker-controlled data through
KeyValueMap can terminate the process, causing a denial of service.Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Serde With