CVE-2023-28118

Katalog CVE

CVSS 7.5 · High EPSS 0,97%

Kerentanan Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') pada kaml project kaml. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.

Rincian

Terbit di NVD

20 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

EPSS (30 hari)

0,97% peluang dieksploitasi; lebih tinggi dari 61,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/charleskorn/kaml/security/advisories/GHSA-c24f-2j3g-rg48 advisory vendor
• https://github.com/charleskorn/kaml/commit/5f82a2d7e00bfc307afca05d1dc4d7c50593531a patch
• https://github.com/charleskorn/kaml/releases/tag/0.53.0 release notes