Executive brief
A denial-of-service vulnerability exists in the Rust library 'serde_with', which is used for data serialization and deserialization. An attacker who can provide specially crafted empty data to an application using this library can cause the application to crash. This results in a loss of service availability but does not directly expose sensitive data.
Technical details
The vulnerability is an improper input validation flaw in the `KeyValueMap` serializer of the `serde_with` crate. The root cause is located in `key_value_map.rs`, where the code preallocates a vector using `Vec::with_capacity(len - 1)` without first verifying that `len` is greater than zero. When an attacker provides an empty inner sequence or map entry, this calculation results in an integer underflow or an invalid capacity request, causing a thread panic. This can be triggered during serialization via `serde_json::to_string` or other Serde serializers when using the `#[serde_as(as = "KeyValueMap<_>")]` attribute. The issue is fixed in version 3.21.0.
Affected products
- jonasbb serde_with < 3.21.0
Timeline
- 2026-06-04: disclosed
- 2026-06-04: patched: Version 3.21.0 released
- 2026-07-15: advisory