What’s Vulnerable › Vulnerabilities

CVE-2023-28118: kaml has potential denial of service while parsing input with anchors and aliases

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-20 · updated 2026-06-17
• Weakness: CWE-776

Description

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.

Affected products

• charleskorn kaml: before 0.53.0 — fixed in 0.53.0

How to fix

Upgrade to a fixed version: charleskorn kaml 0.53.0. Check the vendor advisory for mitigations.

References

• https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a
• https://github.com/charleskorn/kaml/releases/tag/0.53.0
• https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48
• https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a
• https://github.com/charleskorn/kaml/releases/tag/0.53.0
• https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48

Get alerted when CVE-2023-28118 or the next vulnerability affects your stack