Vulnerabilities > CVE-2023-28118 - XML Entity Expansion vulnerability in Kaml Project Kaml

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

kaml-project

CWE-776

NVD

Published: 2023-03-20

Updated: 2023-03-24

Summary

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.

Vulnerable Configurations

Part	Description	Count
Application	Kaml_Project Kaml Project Kaml - Kaml Project Kaml 0.1.0 Kaml Project Kaml 0.2.0 Kaml Project Kaml 0.2.1 Kaml Project Kaml 0.3.0 Kaml Project Kaml 0.4.0 Kaml Project Kaml 0.5.0 Kaml Project Kaml 0.6.0 Kaml Project Kaml 0.7.0 Kaml Project Kaml 0.8.0 Kaml Project Kaml 0.9.0 Kaml Project Kaml 0.10.0 Kaml Project Kaml 0.11.0 Kaml Project Kaml 0.12.0 Kaml Project Kaml 0.13.0 Kaml Project Kaml 0.14.0 Kaml Project Kaml 0.15.0 Kaml Project Kaml 0.16.0 Kaml Project Kaml 0.16.1 Kaml Project Kaml 0.17.0 Kaml Project Kaml 0.18.0 Kaml Project Kaml 0.18.1 Kaml Project Kaml 0.19.0 Kaml Project Kaml 0.20.0 Kaml Project Kaml 0.21.0 Kaml Project Kaml 0.22.0 Kaml Project Kaml 0.23.0 Kaml Project Kaml 0.24.0 Kaml Project Kaml 0.25.0 Kaml Project Kaml 0.26.0 Kaml Project Kaml 0.27.0 Kaml Project Kaml 0.28.0 Kaml Project Kaml 0.28.1 Kaml Project Kaml 0.28.2 Kaml Project Kaml 0.28.3 Kaml Project Kaml 0.29.0 Kaml Project Kaml 0.30.0 Kaml Project Kaml 0.31.0 Kaml Project Kaml 0.32.0 Kaml Project Kaml 0.33.0 Kaml Project Kaml 0.34.0 Kaml Project Kaml 0.35.0 Kaml Project Kaml 0.35.1 Kaml Project Kaml 0.35.2 Kaml Project Kaml 0.35.3 Kaml Project Kaml 0.36.0 Kaml Project Kaml 0.37.0 Kaml Project Kaml 0.38.0 Kaml Project Kaml 0.39.0 Kaml Project Kaml 0.39.1 Kaml Project Kaml 0.40.0 Kaml Project Kaml 0.41.0 Kaml Project Kaml 0.42.0 Kaml Project Kaml 0.43.0 Kaml Project Kaml 0.44.0 Kaml Project Kaml 0.45.0 Kaml Project Kaml 0.46.0 Kaml Project Kaml 0.47.0 Kaml Project Kaml 0.48.0 Kaml Project Kaml 0.49.0 Kaml Project Kaml 0.50.0 Kaml Project Kaml 0.51.0 Kaml Project Kaml 0.52.0	63

Common Weakness Enumeration (CWE)

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References