Read the docs
TI-2021-16579 Aliases CVE-2021-39194GHSA-fmm9-3gv8-58f4

Denial of service while parsing polymorphic input with tagged polymorphism style in kaml

Priority LOW 32CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue.

Why it matters now

EPSS 0.01658 76th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed kaml (charleskorn): 0.35.2com.charleskorn.kaml:kaml (Maven): 0.35.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
charleskornkamlbefore 0.35.20.35.2Patch availableCNA
—com.charleskorn.kaml:kaml (Maven)before 0.35.30.35.3Patch availableGHSA-fmm9-3gv8-58f4
  • kaml Vendorcharleskorn Affected before 0.35.2 Fixed in 0.35.2 Patch available CNA
  • com.charleskorn.kaml:kaml (Maven) Vendor— Affected before 0.35.3 Fixed in 0.35.3 Patch available GHSA-fmm9-3gv8-58f4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kaml_project:kaml:*:*:*:*:*:*:*:*before 0.35.3VulnerableKaml Project
  • cpe:2.3:a:kaml_project:kaml:*:*:*:*:*:*:*:* Versions before 0.35.3 Vulnerable ·Kaml Project

Remediation

  • Fix · CNA kaml (charleskorn) Fixed in 0.35.2
  • Fix · GHSA-fmm9-3gv8-58f4 com.charleskorn.kaml:kaml (Maven) Fixed in 0.35.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39194
  2. 2026-10-03 Alias added: GHSA-fmm9-3gv8-58f4

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2023-12697 kaml has potential denial of service while parsing input with anchors and aliases CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences