chore(deps): update rust crate serde_with to 3.21.0 [security]

renovate commented

2026-07-15 23:52:30 -07:00

Member

This PR contains the following updates:

Package	Type	Update	Change
serde_with	dependencies	minor	`3.7.0` → `3.21.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

serde_with: KeyValueMap serialization panics on empty sequence or map entries

GHSA-7gcf-g7xr-8hxj

More information

Details

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

serde_with/src/key_value_map.rs:590
serde_with/src/key_value_map.rs:599
serde_with/src/key_value_map.rs:613
serde_with/src/key_value_map.rs:632
serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [serde_with](https://github.com/jonasbb/serde_with) | dependencies | minor | `3.7.0` → `3.21.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information. --- ### serde_with: KeyValueMap serialization panics on empty sequence or map entries [GHSA-7gcf-g7xr-8hxj](https://github.com/advisories/GHSA-7gcf-g7xr-8hxj) <details> <summary>More information</summary> #### Details ##### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = "KeyValueMap<_>")]` can be crashed by an empty inner sequence or map entry. ##### Details The affected public surface includes: - Serialization of `#[serde_as(as = "KeyValueMap<_>")]` values through `serde_json::to_string` or any other Serde serializer` - Public `KeyValueMap` conversions for sequence and map-backed entries` The root cause is: The `KeyValueMap` serializer preallocating `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` before checking that the element actually contains the required first key field or item. The vulnerable data/control flow is: attacker-controlled empty entry -> `serde_json::to_string` -> `KeyValueMap<TAs>::serialize_as` -> `SeqAsMapSerializer::{serialize_seq,serialize_map}` -> `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` -> panic Relevant source locations: - `serde_with/src/key_value_map.rs:590` - `serde_with/src/key_value_map.rs:599` - `serde_with/src/key_value_map.rs:613` - `serde_with/src/key_value_map.rs:632` - `serde_with/src/key_value_map.rs:648` ##### PoC ```rust /* [dependencies] serde = {version = "*", features = ["derive"]} serde_with = "*" serde_json = "*" */ use serde::Serialize; use serde_with::{serde_as, KeyValueMap}; #[derive(Serialize)] #[serde(transparent)] struct Seq(Vec<String>); #[serde_as] #[derive(Serialize)] #[serde(transparent)] struct KVMap { #[serde_as(as = "KeyValueMap<_>")] foo: Vec<Seq>, } fn main() { let value = KVMap { foo: vec![Seq(Vec::new())], }; let _ = serde_json::to_string(&value).unwrap(); } ``` ##### Impact A local attacker who can trigger serialization of attacker-controlled data through `KeyValueMap` can terminate the process, causing a denial of service. #### Severity - CVSS Score: 5.1 / 10 (Medium) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj](https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj) - [https://github.com/jonasbb/serde_with/pull/966](https://github.com/jonasbb/serde_with/pull/966) - [https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389](https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389) - [https://github.com/jonasbb/serde_with](https://github.com/jonasbb/serde_with) - [https://github.com/jonasbb/serde_with/compare/v2.2.0...v2.3.0](https://github.com/jonasbb/serde_with/compare/v2.2.0...v2.3.0) - [https://github.com/jonasbb/serde_with/releases/tag/v3.21.0](https://github.com/jonasbb/serde_with/releases/tag/v3.21.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-7gcf-g7xr-8hxj) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-07-15 23:52:31 -07:00

chore(deps): update rust crate serde_with to 3.21.0 [security]

Validate / Check-1 (push) Failing after 1s

Details

Validate / Test Suite-1 (push) Failing after 1s

Details

Validate / Lints (push) Failing after 1s

Details

Validate / Check (push) Has been cancelled

Details

Validate / Check-2 (push) Has been cancelled

Details

Validate / Test Suite (push) Has been cancelled

Details

Validate / Test Suite-2 (push) Has been cancelled

Details

28fcb06cdf

Validate / Check-1 (push) Failing after 1s

Details

Validate / Test Suite-1 (push) Failing after 1s

Details

Validate / Lints (push) Failing after 1s

Details

Validate / Check (push) Has been cancelled

Details

Validate / Check-2 (push) Has been cancelled

Details

Validate / Test Suite (push) Has been cancelled

Details

Validate / Test Suite-2 (push) Has been cancelled

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/crate-serde_with-vulnerability:renovate/crate-serde_with-vulnerability

git checkout renovate/crate-serde_with-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git checkout main

git merge --no-ff renovate/crate-serde_with-vulnerability

git checkout renovate/crate-serde_with-vulnerability

git rebase main

git checkout main

git merge --ff-only renovate/crate-serde_with-vulnerability

git checkout renovate/crate-serde_with-vulnerability

git rebase main

git checkout main

git merge --no-ff renovate/crate-serde_with-vulnerability

git checkout main

git merge --squash renovate/crate-serde_with-vulnerability

git checkout main

git merge --ff-only renovate/crate-serde_with-vulnerability

git checkout main

git merge renovate/crate-serde_with-vulnerability

git push origin main

Rows
Columns

chore(deps): update rust crate serde_with to 3.21.0 [security] #16

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Details

Summary

Details

PoC

Impact

Severity

References

Configuration

Checkout

Merge