CVE-2021-39194

kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue.

• CWE-835

• https://github.com/charleskorn/kaml/commit/e18785d043fc6324c81e968aae9764b4b060bc6aPatch, Third Party Advisory
• https://github.com/charleskorn/kaml/issues/179Exploit, Patch, Third Party Advisory
• https://github.com/charleskorn/kaml/security/advisories/GHSA-fmm9-3gv8-58f4Exploit, Third Party Advisory
• https://github.com/charleskorn/kaml/commit/e18785d043fc6324c81e968aae9764b4b060bc6aPatch, Third Party Advisory
• https://github.com/charleskorn/kaml/issues/179Exploit, Patch, Third Party Advisory
• https://github.com/charleskorn/kaml/security/advisories/GHSA-fmm9-3gv8-58f4Exploit, Third Party Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39189Pimcore is an open source data & experience management platf…5.3
• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
• CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-39192Ghost is a Node.js content management system. An error in th…7.2
• CVE-2021-39193Frontier is Substrate's Ethereum compatibility layer. Prior …5.3
• CVE-2021-39195Misskey is an open source, decentralized microblogging platf…6.5
• CVE-2021-39196pcapture is an open source dumpcap web service interface . I…6.5
• CVE-2021-39197better_errors is an open source replacement for the standard…8.8
• CVE-2021-39198OroCRM is an open source Client Relationship Management (CRM…5.4
• CVE-2021-39199remark-html is an open source nodejs library which compiles …6.1
• CVE-2021-3920grav-plugin-admin is vulnerable to Improper Neutralization o…5.4