Most recent entries from all

EUVD-2026-70664

fkie_cve-2018-20993

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.

GHSA-hv87-47h9-jcvq — Uncontrolled recursion in rust-yaml

Affected: crates.io: yaml-rust

Affected versions of this crate did not prevent deep recursion while deserializing data structures. This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it. The flaw was corrected by checking the recursion depth.

gsd-2018-20993

RUSTSEC-2018-0006 — Uncontrolled recursion leads to abort in deserialization

Affected: crates.io: yaml-rust

Affected versions of this crate did not prevent deep recursion while deserializing data structures.

This allows an attacker to make a YAML file with deeply nested structures that causes an abort while deserializing it.

The flaw was corrected by checking the recursion depth.

Note: `clap 2.33` is not affected by this because it uses `yaml-rust` in a way that doesn't trigger the vulnerability. More specifically:

1. The input to the YAML parser is always trusted - is included at compile time via `include_str!`.

2. The nesting level is never deep enough to trigger the overflow in practice (at most 5).

UBUNTU-CVE-2018-20993

Affected: Ubuntu:20.04:LTS: rust-yaml-rust, Ubuntu:22.04:LTS: rust-yaml-rust, Ubuntu:24.04:LTS: rust-yaml-rust

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.