CVE-2022-38750

MEDIUM

snakeyaml < 1.31 - Denial of Service via Stack Overflow in YAML Parser

Title source: llm
STIX 2.1

Description

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

References (5)

Core 5
Core References
Exploit, Issue Tracking, Mailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202305-28

Scores

CVSS v3 6.5
EPSS 0.0069
EPSS Percentile 72.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-121 CWE-787
Status published
Products (3)
debian/debian_linux 10.0
org.yaml/snakeyaml 0 - 1.31Maven
snakeyaml_project/snakeyaml < 1.31
Published Sep 05, 2022
Tracked Since Feb 18, 2026