AIKIDO-2026-918851
SharpYaml is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
SharpYamlTL;DR
SharpYaml parses and serializes YAML mappings and sequences without enforcing any limit on nesting depth. Processing deeply nested YAML documents or object graphs from untrusted input drives unbounded recursion in the parser, deserializer, and serializer, leading to denial of service. The fix adds a configurable maximum depth and enforces it across parsing, deserialization, and serialization, raising an exception when the limit is exceeded.
Who does this affect?
You are affected if your application uses a vulnerable version of SharpYaml to parse, deserialize, or serialize YAML documents or object graphs derived from untrusted input.
Background info
SharpYaml is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 2.1.4 and 3.0.0 - 3.3.0.
How to fix this
Upgrade the SharpYaml library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant