Repository navigation
Security - Unbounded recursion in deserialization #1109
Description
There is an unbounded security vulnerability in the default serializer.
Thanks to Igor to finding it.
Using the following code you will get a stack overflow exception.
using System;
using YamlDotNet.Serialization;
string yaml = new string('[', 100_000); // deeply nested flow sequences
try
{
new Deserializer().Deserialize<object>(yaml); // crashes with StackOverflowException
}
catch (Exception)
{
// never reached: a StackOverflowException is uncatchable and kills the process
}
Activity
EdwardCooke commentedon Jun 21, 2026
This is now fixed, the default max recursion using the deserializer and deserializerbuilder is 475. Using the default serializer that is the maximum that will not throw an exception during testing.
EdwardCooke commentedon Jun 21, 2026
Looks like Windows handles exceptions differently than Linux. The exceptions are placed on the stack, very interesting. This made the limit in tests for Windows actually bee 152 so that is what I set the default to.