Crystal 1.20.3 is a security patch release fixing two vulnerabilities in the YAML parsers. The first fix adds a maximum nesting depth limit to prevent stack overflows from deeply nested YAML documents. The second fix addresses the 'billion laughs' alias expansion attack by adding an alias-to-anchor ratio check, preventing exponential node expansion that could severely slow down applications. Upgrading is recommended for any application that processes YAML from untrusted sources.
1.8K Impressions