Skip to content
Fencer Intel
medium —

GHSA-hhw4-xg65-fp2x json

serde_yml crate is unsound and unmaintained

published last yr. modified last yr. also RUSTSEC-2025-0068

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Using `serde_yml::ser::Serializer.emitter` can cause a segmentation fault, which is unsound.

The GitHub project for `serde_yml` was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

## Recommended alternatives

- [`serde_norway`](https://crates.io/crates/serde_norway) - Maintained fork of `serde_yaml`, using `unsafe-libyaml-norway` - [`serde_yaml_ng`](https://crates.io/crates/serde_yaml_ng) - Maintained fork of `serde_yaml`, using unmaintained `unsafe-libyaml`

## Incomplete pure Rust alternatives

These implementation do not rely on C `libyaml`.

- [`serde_yaml2`](https://crates.io/crates/serde_yaml2) - [`yaml-peg`](https://crates.io/crates/yaml-peg)

Is GHSA-hhw4-xg65-fp2x in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io serde_yml
<=0.0.12
>=0.0.0-0
 no fix listed

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.