serde_with

Version	Released
`3.23.0` minor	Sep 07, 2026
`3.22.0` minor	Aug 09, 2026
`3.21.0` unknown	Jun 04, 2026
`3.20.0` unknown 1 CVE	May 10, 2026
`3.19.0` unknown 1 CVE	May 02, 2026
`3.18.0` unknown 1 CVE	Mar 13, 2026
`3.17.0` unknown 1 CVE	Feb 25, 2026
`3.16.1` unknown 1 CVE	Nov 27, 2025
`3.16.0` unknown 1 CVE	Nov 14, 2025
`3.15.1` unknown 1 CVE	Oct 21, 2025
`3.15.0` unknown 1 CVE	Oct 03, 2025
`3.14.1` unknown 1 CVE	Sep 19, 2025
`3.14.0` unknown 1 CVE	Jun 30, 2025
`3.13.0` unknown 1 CVE	Jun 14, 2025
`3.12.0` unknown 1 CVE	Dec 25, 2024
`3.11.0` unknown 1 CVE	Oct 05, 2024
`3.10.0` unknown 1 CVE	Oct 01, 2024
`3.9.0` unknown 1 CVE	Jul 14, 2024
`3.8.3` unknown 1 CVE	Jul 03, 2024
`3.8.2` unknown 1 CVE	Jun 30, 2024
`3.8.1` unknown 1 CVE	Apr 28, 2024
`3.8.0` unknown 1 CVE	Apr 24, 2024
`3.7.0` unknown 1 CVE	Mar 11, 2024
`3.6.1` unknown 1 CVE	Feb 08, 2024
`3.6.0` unknown 1 CVE	Jan 30, 2024
`3.5.1` unknown 1 CVE	Jan 23, 2024
`3.5.0` unknown 1 CVE	Jan 21, 2024
`3.4.0` unknown 1 CVE	Oct 17, 2023
`3.3.0` unknown 1 CVE	Aug 19, 2023
`3.2.0` unknown 1 CVE	Aug 04, 2023
`3.1.0` unknown 1 CVE	Jul 17, 2023
`3.0.0` unknown 1 CVE	May 01, 2023
`2.3.3` unknown 1 CVE	Apr 27, 2023
`2.3.2` unknown 1 CVE	Apr 05, 2023
`2.3.1` unknown 1 CVE	Mar 10, 2023
`2.3.0` unknown 1 CVE	Mar 09, 2023
`2.2.0` unknown	Jan 09, 2023
`2.1.0` unknown	Nov 16, 2022
`2.0.1` unknown	Sep 09, 2022
`2.0.0` unknown	Jul 17, 2022
`2.0.0-rc.0` unknown	Jun 29, 2022
`1.14.0` unknown	May 29, 2022
`1.13.0` unknown	Apr 23, 2022
`1.12.1` unknown	Apr 07, 2022
`1.12.0` unknown	Feb 07, 2022
`1.11.0` unknown	Oct 18, 2021
`1.10.0` unknown	Sep 04, 2021
`1.9.4` unknown	Jun 18, 2021
`1.9.3` unknown	Jun 14, 2021
`1.9.2` unknown	Jun 07, 2021

3.23.0 minor

Sep 07, 2026

3.22.0 minor

Aug 09, 2026

3.21.0 unknown

Jun 04, 2026

3.20.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 10, 2026

3.19.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 02, 2026

3.18.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 13, 2026

3.17.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 25, 2026

3.16.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 27, 2025

3.16.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 14, 2025

3.15.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 21, 2025

3.15.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 03, 2025

3.14.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 19, 2025

3.14.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 30, 2025

3.13.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 14, 2025

3.12.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 25, 2024

3.11.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 05, 2024

3.10.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 01, 2024

3.9.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 14, 2024

3.8.3 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 03, 2024

3.8.2 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 30, 2024

3.8.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 28, 2024

3.8.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 24, 2024

3.7.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 11, 2024

3.6.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 08, 2024

3.6.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 30, 2024

3.5.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 23, 2024

3.5.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 21, 2024

3.4.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 17, 2023

3.3.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 19, 2023

3.2.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 04, 2023

3.1.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 17, 2023

3.0.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

May 01, 2023

2.3.3 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 27, 2023

2.3.2 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 05, 2023

2.3.1 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 10, 2023

2.3.0 unknown

1 CVE

GHSA-7gcf-g7xr-8hxj Jul 15, 2026

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Medium

Local Low None None

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Fixed in


          3.21.0

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 09, 2023

2.2.0 unknown

Jan 09, 2023

2.1.0 unknown

Nov 16, 2022

2.0.1 unknown

Sep 09, 2022

2.0.0 unknown

Jul 17, 2022

2.0.0-rc.0 unknown

Jun 29, 2022

1.14.0 unknown

May 29, 2022

1.13.0 unknown

Apr 23, 2022

1.12.1 unknown

Apr 07, 2022

1.12.0 unknown

Feb 07, 2022

1.11.0 unknown

Oct 18, 2021

1.10.0 unknown

Sep 04, 2021

1.9.4 unknown

Jun 18, 2021

1.9.3 unknown

Jun 14, 2021

1.9.2 unknown

Jun 07, 2021

Activity

Reach

Details