---
id: GHSA-7gcf-g7xr-8hxj
title: 'serde_with: KeyValueMap serialization panics on empty sequence or map entries'
summary: 'serde_with: KeyValueMap serialization panics on empty sequence or map entries'
severity: medium
cwe:
  - CWE-20
vendor: serde_with
product: serde_with
ecosystem: rust
affected:
  - serde_with < 3.21.0
patched:
  - serde_with 3.21.0
published: '2026-07-15'
updated: '2026-07-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7gcf-g7xr-8hxj'
references:
  - url: >-
      https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj
  - url: 'https://github.com/jonasbb/serde_with/pull/966'
  - url: >-
      https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389
  - url: 'https://github.com/jonasbb/serde_with/releases/tag/v3.21.0'
  - url: 'https://github.com/advisories/GHSA-7gcf-g7xr-8hxj'
tags:
  - ghsa
  - rust
ingestedAt: '2026-07-15T22:46:58.751Z'
---

## Overview

### Summary

The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = "KeyValueMap<_>")]` can be crashed by an empty inner sequence or map entry.

### Details

The affected public surface includes:

- Serialization of `#[serde_as(as = "KeyValueMap<_>")]` values through `serde_json::to_string` or any other Serde serializer`
- Public `KeyValueMap` conversions for sequence and map-backed entries`

The root cause is: The `KeyValueMap` serializer preallocating `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> `serde_json::to_string` -> `KeyValueMap<TAs>::serialize_as` -> `SeqAsMapSerializer::{serialize_seq,serialize_map}` -> `Vec::with_capacity(len - 1)` or `Vec::with_capacity(len.unwrap_or(17) - 1)` -> panic

Relevant source locations:

- `serde_with/src/key_value_map.rs:590`
- `serde_with/src/key_value_map.rs:599`
- `serde_with/src/key_value_map.rs:613`
- `serde_with/src/key_value_map.rs:632`
- `serde_with/src/key_value_map.rs:648`

### PoC

```rust
/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]
#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]
#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}
```

### Impact

A local attacker who can trigger serialization of attacker-controlled data through `KeyValueMap` can terminate the process, causing a denial of service.

## Affected packages

- `serde_with < 3.21.0`

## Remediation

Upgrade to a patched release:

- `serde_with 3.21.0`