AIKIDO-2026-11081
serde_with is vulnerable to Denial of Service
51
Medium Risk
This Affects:
serde_withTL;DR
The KeyValueMap serializer in serde_with preallocates collection capacities from caller-supplied lengths and size hints without bounds checks. When serializing attacker-influenced data that contains empty inner sequences, empty map entries, or oversized size hints, the allocator panics during capacity calculation. A peer who can shape values fed to a serde_as(as = "KeyValueMap<_>") serializer can therefore crash the host process and deny service. The fix routes all collection creations through a cautious size-hint helper that caps reservation requests to a safe maximum.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
serde_with is vulnerable to Denial of Service in versions 0.0.1 - 3.20.0.
How to fix this
Upgrade the serde_with library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.