Security readout for executives and security teams
Plain-English summary
CVE-2021-39194 can let someone who can submit YAML to a kaml-using application make parsing loop indefinitely. The impact is service availability, not data theft. It matters most for internet-facing or multi-tenant services that parse user-supplied YAML with kaml polymorphic serialization.
Executive priority
Prioritize remediation for public-facing or customer-supplied YAML processing services. The issue is not critical, but a simple malformed input can degrade availability in affected configurations. Internal-only systems with trusted input are lower urgency.
Technical view
Affected kaml versions can endlessly loop when parsing polymorphic YAML using the default tagged polymorphism style, specifically when input includes a tag without an object value. Property polymorphism style is stated as unaffected. The weakness maps to CWE-835 and has CVSS 3.1 score 4.3.
Likely exposure
Exposure is limited to applications using charleskorn kaml, accepting attacker-controlled YAML, and using polymorphic serialization with the default tagged style. Applications not using kaml, not parsing untrusted YAML, or using property polymorphism style are not indicated as affected.
Exploitation context
The provided sources do not show KEV listing or active exploitation. Exploitation requires the ability to provide arbitrary YAML input to an affected application. The expected result is resource starvation or denial of service, not confidentiality or integrity compromise.
Researcher notes
The source bundle contains a version ambiguity: the description says 0.35.3 or later contains the fix, while the affected entry lists versions below 0.35.2. Use the GitHub advisory and commit history as the deciding source during verification.
Mitigation direction
- Inventory kaml dependency versions across applications and services.
- Upgrade affected kaml deployments to the vendor-fixed release line.
- Review vendor advisory because source data differs on exact fixed version.
- Use property polymorphism style where compatible with application behavior.
- Restrict or reject untrusted YAML input where it is unnecessary.
- Monitor YAML parsing services for CPU saturation or request hangs.
Validation and detection
- Confirm whether applications accept user-controlled YAML input.
- Check whether kaml polymorphic serialization is enabled.
- Identify use of default tagged polymorphism style.
- Verify deployed kaml version against vendor advisory guidance.
- Run controlled regression testing for parser hangs after upgrading.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-835: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-39194 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/charleskorn/kaml/security/advisories/GHSA-fmm9-3gv8-58f4CVE reference · x_refsource_CONFIRM
- https://github.com/charleskorn/kaml/issues/179CVE reference · x_refsource_MISC
- https://github.com/charleskorn/kaml/commit/e18785d043fc6324c81e968aae9764b4b060bc6aCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Loop with Unreachable Exit Condition ('Infinite Loop')
Loop with Unreachable Exit Condition ('Infinite Loop') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.