The KeyValueMap serializer in serde_with versions prior to 3.21.0 improperly handles empty inner sequences or map entries by preallocating a vector with a capacity of length minus one without verifying the presence of required key fields. This leads to a panic during serialization when an empty entry is encountered. The vulnerability can be triggered via serde_json::to_string or any Serde serializer that uses KeyValueMap, allowing an attacker controlling serialized data to cause a denial of service by crashing the process.

A local attacker who can supply attacker-controlled data for serialization using the KeyValueMap serializer can cause the application to panic and terminate, resulting in a denial of service. There is no indication of privilege escalation, data disclosure, or remote code execution.

No official patch or fix is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, avoid serializing untrusted or attacker-controlled data with KeyValueMap or implement input validation to ensure no empty sequences or map entries are serialized.