serde_with: KeyValueMap serialization panics on empty sequence or map entries

The KeyValueMap serializer in serde_with versions >=2.3.0 and <3.21.0 assumes that each mapped element contains at least one field or item to serve as the map key. It preallocates a vector with capacity of length minus one before verifying this assumption. If an attacker supplies an empty inner sequence or map entry, this leads to a panic due to Vec::with_capacity being called with an invalid size. This vulnerability can be triggered via serialization through serde_json::to_string or other Serde serializers when using #[serde_as(as = "KeyValueMap<_>")]. The root cause is improper length validation before vector preallocation in key_value_map.rs at multiple source locations.

An attacker who can supply attacker-controlled data for serialization through the KeyValueMap serializer can cause the process to panic and terminate, resulting in a denial of service. There is no indication of privilege escalation or code execution. The impact is limited to local denial of service via process crash during serialization.

A patch is available for this vulnerability. Users of serde_with should upgrade to version 3.21.0 or later where this issue is fixed. Until patched, avoid serializing attacker-controlled data with KeyValueMap or implement input validation to prevent empty sequences or map entries. No vendor advisory content contradicts this guidance.