CVE-2018-1051

8.1 highEPSS 1.3%

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.

Severity

CVSS 3.0

8.1 high

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWEs: CWE-502, CWE-20
Published: 2018-01-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:resteasy

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-m2fv-3rqm-g7p5	Maven	org.jboss.resteasy:resteasy-yaml-provider	<3.0.26.Final	3.0.26.Final
GHSA-m2fv-3rqm-g7p5	Maven	org.jboss.resteasy:resteasy-yaml-provider	>=3.1.0 <3.6.0.Final	3.6.0.Final

References

https://bugzilla.redhat.com/show_bug.cgi?id=1535411
https://bugzilla.redhat.com/show_bug.cgi?id=1535411

Check your stack JSON