GHSA-c24f-2j3g-rg48
kaml has potential denial of service while parsing input with anchors and aliases
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.charleskorn.kaml:kaml | < 0.53.0 | 0.53.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash.
### Patches
Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases.
### Workarounds
None.
### References
Wikipedia has an explanation of this class of vulnerability: [billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack)
### Acknowledgements
Thank you to @gdude2002 for reporting this issue.
References
External links from the advisory. They lead to third-party sites.