CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2022-38749
Medium (6.5). EPSS 2.2% chance of exploitation in the next 30 days. Fixed in org.yaml:snakeyaml 1.31.
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Severity
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-787, CWE-121
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- snakeyaml_project:snakeyaml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c4r9-r8fh-9vj2 | Maven | org.yaml:snakeyaml | <1.31 | 1.31 |
| GHSA-c4r9-r8fh-9vj2 | Maven | be.cylab:snakeyaml | 1.25.1 | no fix published |
| GHSA-c4r9-r8fh-9vj2 | Maven | com.alipay.sofa.acts:acts-common-util | 1.0.0 | no fix published |
| GHSA-c4r9-r8fh-9vj2 | Maven | io.prometheus.jmx:jmx_prometheus_httpserver | 0.17.0 | no fix published |
| GHSA-c4r9-r8fh-9vj2 | Maven | io.prometheus.jmx:jmx_prometheus_httpserver_java6 | <=0.18.0 | no fix published |
| GHSA-c4r9-r8fh-9vj2 | Maven | org.testifyproject.external:external-snakeyaml | <=1.0.6 | no fix published |
| GHSA-c4r9-r8fh-9vj2 | Maven | pl.droidsonroids.yaml:snakeyaml | <=1.18.2 | no fix published |
References
- https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024
- https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
- https://security.gentoo.org/glsa/202305-28
- https://security.netapp.com/advisory/ntap-20240315-0010/