CVE-2022-38749

MEDIUM

snakeyaml < 1.31 - Denial of Service via Stack Overflow in YAML Parser

Title source: llm

Description

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

References (5)

Core 5

Core References

Third Party Advisory

https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open

Third Party Advisory

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240315-0010/

Mailing List, Third Party Advisory mailing-list

https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html

Third Party Advisory vendor-advisory

https://security.gentoo.org/glsa/202305-28

Scores

CVSS v3 6.5

EPSS 0.0053

EPSS Percentile 67.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-121 CWE-787

Status published

Products (9)

be.cylab/snakeyaml Maven

com.alipay.sofa.acts/acts-common-util Maven

debian/debian_linux 10.0

io.prometheus.jmx/jmx_prometheus_httpserver Maven

io.prometheus.jmx/jmx_prometheus_httpserver_java6 0Maven

org.testifyproject.external/external-snakeyaml 0Maven

org.yaml/snakeyaml 0 - 1.31Maven

pl.droidsonroids.yaml/snakeyaml 0Maven

snakeyaml_project/snakeyaml < 1.31

Published Sep 05, 2022

Tracked Since Feb 18, 2026