{"id":"GHSA-7gcf-g7xr-8hxj","aliases":[],"url":"https://o3.security/vulnerability/GHSA-7gcf-g7xr-8hxj","summary":"serde_with: KeyValueMap serialization panics on empty sequence or map entries","details":"### Summary\n\nThe public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = \"KeyValueMap<_>\")]` can be crashed by an empty inner sequence or map entry.\n\n### Details\n\nThe affected public surface includes:\n\n- Serialization of `#[serde_as(as = \"KeyValueMap<_>\")]` values through `serde_json::to_string` or any other Serde serializer`\n- Public `KeyValueMap` conversions for sequence and map-backed entries`\n\nThe root cause is: The `KeyValueMap` serializer preallocating `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` before checking that the element actually contains the required first key field or item.\n\nThe vulnerable data/control flow is: attacker-controlled empty entry -> `serde_json::to_string` -> `KeyValueMap<TAs>::serialize_as` -> `SeqAsMapSerializer::{serialize_seq,serialize_map}` -> `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` -> panic\n\nRelevant source locations:\n\n- `serde_with/src/key_value_map.rs:590`\n- `serde_with/src/key_value_map.rs:599`\n- `serde_with/src/key_value_map.rs:613`\n- `serde_with/src/key_value_map.rs:632`\n- `serde_with/src/key_value_map.rs:648`\n\n### PoC\n\n```rust\n/*\n[dependencies]\nserde = {version = \"*\", features = [\"derive\"]}\nserde_with = \"*\"\nserde_json = \"*\"\n*/\n\nuse serde::Serialize;\nuse serde_with::{serde_as, KeyValueMap};\n\n#[derive(Serialize)]\n#[serde(transparent)]\nstruct Seq(Vec<String>);\n\n#[serde_as]\n#[derive(Serialize)]\n#[serde(transparent)]\nstruct KVMap {\n    #[serde_as(as = \"KeyValueMap<_>\")]\n    foo: Vec<Seq>,\n}\n\nfn main() {\n    let value = KVMap {\n        foo: vec![Seq(Vec::new())],\n    };\n    let _ = serde_json::to_string(&value).unwrap();\n}\n```\n\n### Impact\n\nA local attacker who can trigger serialization of attacker-controlled data through `KeyValueMap` can terminate the process, causing a denial of service.","published":"2026-07-15T22:41:01Z","modified":"2026-09-10T03:51:10.897685062Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"serde_with","fixedVersion":"3.21.0"}],"fix":{"url":"https://github.com/jonasbb/serde_with/pull/966","label":"jonasbb/serde_with#966"},"references":[{"type":"WEB","url":"https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj"},{"type":"WEB","url":"https://github.com/jonasbb/serde_with/pull/966"},{"type":"WEB","url":"https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389"},{"type":"PACKAGE","url":"https://github.com/jonasbb/serde_with"},{"type":"WEB","url":"https://github.com/jonasbb/serde_with/compare/v2.2.0...v2.3.0"},{"type":"WEB","url":"https://github.com/jonasbb/serde_with/releases/tag/v3.21.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:51:10.897685062Z"}}